RapidJSON: Out-of-bounds read in Regex Parser (CVE-2026-116620)

hello@craftedsignal.io — Tue, 27 Oct 2026 01:52:21 +0000

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. The issue affects the function GenericStringStream>::Take in the file include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to an out-of-bounds read and can be initiated remotely. The exploit has been disclosed publicly. The project was informed of the problem but has not responded.

Rapidjson - CraftedSignal Threat Feed

RapidJSON: Out-of-bounds read in Regex Parser (CVE-2026-116620)