{"id":"CVE-2026-47235","kind":"vulnerability","aliases":["CVE-2026-47235"],"related":[],"title":"SimulationCraft: oversized socket list overflows gem arrays, enabling code execution","description":"SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data[\"sockets\"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.","summary":"SimulationCraft's Battle.net profile importer writes more socket entries than its four-element gem arrays can hold, corrupting heap memory. An attacker who supplies a crafted profile can crash the tool and, per the advisory, run code.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","simulationcraft","world-of-warcraft"],"not_affected_if":["fixed-nightly","trusted-input-only"],"how_to_check":"- Run `simc --version` or check the build identifier; builds after `release-820-01` and before the May 7, 2026 nightly are exposed.\n- Check whether imports from `.simc` files or Battle.net API data are used on the machine.","fix":"- Update SimulationCraft to nightly build `simc-1205-01-516b5d7` or later; no containing release tag is available.\n- Until updated, import only profiles from trusted sources.","status":"open","published_at":"2026-10-28T16:17:07+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:54+00:00","updated_at":"2026-10-28T16:35:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T16:35:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update SimulationCraft to nightly build `simc-1205-01-516b5d7` or later; no containing release tag is available.\n- Until updated, import only profiles from trusted sources.","reach":"local","title":"SimulationCraft: oversized socket list overflows gem arrays, enabling code execution","impact":"high","summary":"SimulationCraft's Battle.net profile importer writes more socket entries than its four-element gem arrays can hold, corrupting heap memory. An attacker who supplies a crafted profile can crash the tool and, per the advisory, run code.","category":"package","nicknames":[],"who_cares":["simulationcraft","world-of-warcraft","c++"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker code runs on the machine that imports a crafted profile","analyst_note":"Confirm the exact affected build range and whether any release tag contains the fix, from the NVD entry and the SimulationCraft repository.","how_to_check":"- Run `simc --version` or check the build identifier; builds after `release-820-01` and before the May 7, 2026 nightly are exposed.\n- Check whether imports from `.simc` files or Battle.net API data are used on the machine.","needs_analyst":true,"not_affected_if":["fixed-nightly","trusted-input-only"],"who_is_affected":"Users who run SimulationCraft builds between release-820-01 and the May 7, 2026 nightly and import untrusted character profiles, addon exports, or Battle.net API data. Anyone on a release tag at or before release-820-01, or on the fixed nightly, is not affected by this flaw.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3645,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-01':79C,235C '-1205':234C '-2026':12A,15A '-47235':13A,16A '-516':236C '-820':78C '2026':86C '7':85C 'access':152C 'addon':208C 'adjac':141C 'advisori':59B,182C 'also':151C 'api':212C 'array':7A,39B,95C,122C 'arriv':196C 'attack':46B,175C,193C,217C 'attacker-influenc':174C 'avail':243C 'b5d7':237C 'battle.net':26B,211C 'bcp_api.cpp':89C 'beyond':136C 'bonus':120C,143C,147C,154C 'bound':102C,158C 'build':75C,230C 'c':17B 'caus':166C 'cleanup':180C 'code':9A,61B,186C 'combat':68C 'compromis':207C 'contain':226C,239C 'corrupt':42B,159C 'craft':50B 'crash':53B,184C 'cve':11A,14A 'data':98C 'demonstr':188C 'destin':115C 'destructor':170C 'element':37B,128C 'enabl':8A 'engine/item/item.hpp':124C 'engine/sc_enums.hpp':113C 'entri':32B,133C,149C 'environ':192C 'equip':204C 'execut':10A,187C 'explor':67C 'export':209C 'fix':224C 'four':36B,111C,127C,131C 'four-el':35B 'free':172C 'gem':6A,38B,103C,107C,116C,119C,137C,142C,153C 'heap':43B 'hold':41B 'id':117C,121C,138C,144C,155C 'identifi':83C,231C 'idx':104C 'import':28B 'influenc':176C 'input':194C 'item':168C 'json':93C 'list':4A,148C 'loop':90C 'm':163C 'malici':199C 'max':106C 'may':84C 'mechan':69C 'memori':44B 'modifi':214C 'network':221C 'night':87C,229C 'normal':179C 'overflow':5A 'overs':2A 'packag':18B 'per':57B 'pointer':165C,177C 'posit':222C 'privileg':220C 'profil':27B,51B,201C 'releas':77C,240C 'report':183C 'respons':213C 'run':60B 'section':205C 'simc':200C,233C 'simulationcraft':1A,19B,24B,62C 'size':100C 'slot':97C,108C 'socket':3A,31B,94C,99C,132C 'start':164C 'storag':146C 'suppli':48B 'tag':241C 'test':191C 'therefor':134C 'tool':55B,65C 'use':96C 'vector':145C,161C 'warcraft':23B,73C 'without':101C 'world':21B,71C 'world-of-warcraft':20B 'write':29B,135C","nicknames":[],"mitigations":[],"who_affected":"Users who run SimulationCraft builds between release-820-01 and the May 7, 2026 nightly and import untrusted character profiles, addon exports, or Battle.net API data. Anyone on a release tag at or before release-820-01, or on the fixed nightly, is not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47235","severity":null,"published_at":"2026-10-28T16:17:07+00:00","modified_at":"2026-10-28T16:17:07+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}