CVE-2026-124586: 
Linux Red Hat 脆弱性分析と緩和策

CVE-2026-124586 is a heap-buffer-overflow (out-of-bounds read) vulnerability in Tencent RapidJSON 1.1.0, affecting the GetCachedPowerByIndex() function in include/rapidjson/internal/diyfp.h. The flaw is triggered by an integer underflow in the decimalPosition argument during full-precision floating-point parsing, leading to an out-of-bounds array access. It was reported via a GitHub issue on October 16, 2026, and published to the NVD and GitHub Advisory Database on November 9, 2026; the Tencent RapidJSON project had not responded to the report at time of disclosure. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, RapidJSON Issue).

The root cause is an integer underflow (CWE-119/CWE-125) in RapidJSON's full-precision float parsing path. When parsing a floating-point number with kParseFullPrecisionFlag, the decimalPosition variable underflows to 0xFFFFFFFFFFFFFFF0 (-16), which is then passed to StrtodDiyFp(). This function computes an array index of approximately 536,870,895 into the kCachedPowers_F array, which contains only ~87 elements, resulting in an out-of-bounds read. A minimal 46-byte proof-of-concept input — the string "1.1" followed by 192 zeros — is sufficient to trigger the vulnerability when parsed via Document::Parse() (RapidJSON Issue, Github Advisory).

Successful exploitation can result in memory disclosure (reading sensitive data from heap memory adjacent to the kCachedPowers_F array), application state corruption, or a service crash (denial of service). Because the attack requires no authentication or user interaction and is remotely exploitable over the network, any application that accepts untrusted JSON input and parses it using RapidJSON 1.1.0 with full-precision mode is at risk. The confidentiality, integrity, and availability impacts are each rated Low in isolation, but the combination and the library's widespread use in C++ applications amplify the overall risk (Github Advisory, RapidJSON Issue).

A proof-of-concept input has been publicly disclosed in the GitHub issue report, consisting of a 46-byte crafted JSON string ("1.1" followed by 192 zeros) that reliably triggers the out-of-bounds read. As of the disclosure date, there is no evidence of active in-the-wild exploitation, no known threat actor attribution, and no CISA KEV catalog listing. The EPSS score is reported as 0.0, reflecting low current exploitation probability (RapidJSON Issue, Github Advisory).

1. Identify target: Locate applications that accept untrusted JSON input and use Tencent RapidJSON 1.1.0 with kParseFullPrecisionFlag enabled (e.g., via doc.Parse<kParseFullPrecisionFlag>(input) or equivalent).
2. Craft malicious payload: Construct a JSON floating-point string designed to trigger the integer underflow — the known PoC is "1.1" followed by 192 zero digits (total 46 bytes): "1.1" + std::string(192, '0').
3. Deliver payload: Submit the crafted JSON to the target application through any available input channel (HTTP request body, API endpoint, file upload, message queue, etc.).
4. Trigger out-of-bounds read: The parser's decimalPosition underflows to -16 (0xFFFFFFFFFFFFFFF0), causing StrtodDiyFp() to compute an out-of-bounds array index (~536,870,895) into kCachedPowers_F.
5. Achieve objective: Depending on memory layout and application behavior, the attacker may read sensitive heap memory contents, cause application state corruption, or crash the service (RapidJSON Issue).

• Network: Unusual JSON payloads in HTTP request bodies or API calls containing floating-point numbers with an abnormally large number of decimal digits (e.g., 1.1 followed by 100+ zeros).
• Logs: Application crash logs or core dumps referencing GetCachedPowerByIndex(), StrtodDiyFp(), or diyfp.h in stack traces; segmentation fault or heap corruption errors in application logs.
• Process: Unexpected application crashes or restarts in services that process JSON input; memory sanitizer (AddressSanitizer/Valgrind) alerts indicating heap-buffer-overflow in rapidjson::internal::GetCachedPowerByIndex (RapidJSON Issue).

The GitHub Advisory Database lists a patch as available, though specific patched version numbers have not been confirmed by the Tencent RapidJSON project as of the disclosure date. Organizations should monitor the RapidJSON GitHub repository for an official fix and upgrade as soon as one is released. As an interim workaround, restrict network access to services that process untrusted JSON using RapidJSON 1.1.0, implement input validation to reject floating-point values with excessive decimal digits before passing them to the parser, or avoid using kParseFullPrecisionFlag where not strictly required (Github Advisory, RapidJSON Issue).

The vulnerability was reported to the Tencent RapidJSON project via GitHub Issue #2405 on October 16, 2026, but the project had not responded at the time of public disclosure on November 9, 2026. The GitHub Advisory Database has classified it as "Moderate" severity and marked it as unreviewed, with no known patched package version identified. No significant broader media coverage or notable researcher commentary beyond the original issue report has been observed (Github Advisory, RapidJSON Issue).