CVE-2026-47235— SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

Quick assessment

Affected

simulationcraft simc

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SimulationCraft 是一款用于探索《魔兽世界》战斗机制的工具。在 release-820-01 版本之后、2026 年 5 月 7 日夜间构建版本之前发布的构建版本中，在遍历 JSON 数组时，使用了来循环，但未将索引限制在（该常量在中定义为 4）以内。而目标数组和（定义于）均仅包含四个元素。因此，当存在超过四个插槽条目时，程序会将数据写入数组之外，越界覆盖相邻的向量存储区；同时，中的条目也可能越界访问。这种越界写入会破坏向量的指针，导致在正常清理过程中，的析构函数释放了由攻

CVSS 7.5 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
simulationcraft	simc	`< aff85992d284ca4621e784c6b065a271b22f629d`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

Source: CVE Program / CVE List V5

Vulnerability Description

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
simulationcraft	simc	< aff85992d284ca4621e784c6b065a271b22f629d	-

II. Public POCs for CVE-2026-47235

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-47235

请登录查看更多情报信息。

Other References for CVE-2026-47235 (2)

https://github.com/simulationcraft/simc/security/advisories/GHSA-wc9c-hfh3-phxx x_refsource_CONFIRM
https://github.com/simulationcraft/simc/commit/aff85992d284ca4621e784c6b065a271b22f629d x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-47235

IV. Related Vulnerabilities

Same weakness: CWE-122