CVE-2026-124586: fallo de gravedad media en Tencent RapidJSON
Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
Tencent · RapidJSONCVEs relacionadas — Tencent RapidJSON
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-39684MEDIUMTencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer OverflowEPSS 0.4%CVE-2024-38517MEDIUMTencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer UnderflowEPSS 0.4%CVE-2026-116620MEDIUMTencent RapidJSON Regex stream.h Take out-of-boundsEPSS 0.3%