RapidJSON: Out-of-bounds read in Regex Parser (CVE-2026-116620)
Tencent RapidJSON versions up to 1.1.0 contain an out-of-bounds read vulnerability in the GenericStringStream function within the Regex Parser component.
CVE search metadata
CVE search record: CVE-2026-116620. Severity: high. CVSS: 7.3. KEV: no. Product: RapidJSON (<= 1.1.0). Brief: RapidJSON: Out-of-bounds read in Regex Parser (CVE-2026-116620). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rapidjson-oob-read/
Triage facts
Revision 1- Applicability
- RapidJSON (<= 1.1.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 01:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. The issue affects the function GenericStringStream<UTF8<char>>::Take in the file include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to an out-of-bounds read and can be initiated remotely. The exploit has been disclosed publicly. The project was informed of the problem but has not responded.