CVE-2026-116620: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2026-116620 is a heap-buffer-overflow (out-of-bounds read) vulnerability in the Regex Parser component of Tencent RapidJSON, a widely used C++ JSON parsing library. The flaw exists in the GenericStringStream<UTF8<char>>::Take() function within include/rapidjson/stream.h and can be triggered remotely by supplying a crafted regular expression. Affected versions are RapidJSON 1.0 and 1.1.0 (the latest stable release); no patched upstream release has been issued as of disclosure. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Feedly). The vulnerability was reported to the project on October 11, 2026 via GitHub Issue #2401 and publicly disclosed on October 27, 2026; the maintainers had not responded at the time of disclosure (RapidJSON Issue).

The root cause is an unbounded memory read (CWE-125 / CWE-119): GenericStringStream::Take() in stream.h:116 is implemented as Ch Take() { return *src_++; } with no bounds check. When the Regex Parser (GenericRegex::Parse()) processes a malformed UTF-8 sequence — specifically a trailing \xf0 byte (an incomplete 4-byte UTF-8 leading byte) inside a character class — the UTF-8 decoder (UTF8::Decode()) requests additional bytes beyond the allocated buffer, causing Take() to read one byte past the end of the heap allocation. The full call chain is: GenericRegex::Parse() → DecodedStream::Take() → UTF8::Decode() → GenericStringStream::Take(). A 22-byte PoC input ([-z\+.7;]a-z`+.7;]<)\xf0) reliably triggers the crash, confirmed with AddressSanitizer on RapidJSON v1.1.0 compiled with afl-clang-fast++([RapidJSON Issue](https://github.com/Tencent/rapidjson/issues/2401)). The suggested fix is to add a bounds check:if (src_ >= head_ + length_) return static_cast<Ch>(0);` before the dereference (RapidJSON Issue).

Successful exploitation can crash any application that passes attacker-controlled input to RapidJSON's Regex Parser, resulting in denial of service. Additionally, the out-of-bounds read may leak adjacent heap memory contents, creating a potential information disclosure risk. Applications most at risk include those performing JSON Schema validation using the pattern or patternProperties keywords, or any code that directly instantiates rapidjson::internal::GenericRegex with user-supplied data (RapidJSON Issue, Github Advisory). Given RapidJSON's widespread use as a header-only library embedded in many C++ projects, the blast radius extends to any downstream application that has not independently patched the affected code.

A 22-byte proof-of-concept input has been publicly disclosed in GitHub Issue #2401, demonstrating reliable crash reproduction under AddressSanitizer (RapidJSON Issue). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT, and no authentication or user interaction is required for exploitation (Github Advisory). As of disclosure, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and the EPSS score is 0.0 (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate an application that uses Tencent RapidJSON v1.0 or v1.1.0 and exposes an interface accepting user-supplied JSON Schema (with pattern/patternProperties) or raw regex strings processed by rapidjson::internal::GenericRegex.
2. Craft malicious input: Prepare a 22-byte payload containing a malformed UTF-8 sequence within a regex character class, e.g., [-z\+.7;]a-z`+.7;]<)\xf0(hex:5b2d7a602b0a373b5d612d7a602b0a373b5d3c29f0`), as documented in the public PoC (RapidJSON Issue).
3. Deliver payload: Submit the crafted regex as the value of a pattern keyword in a JSON Schema document, or directly as input to any API endpoint that invokes GenericRegex construction with attacker-controlled data.
4. Trigger out-of-bounds read: The Regex Parser calls GenericRegex::Parse(), which invokes UTF8::Decode() on the trailing \xf0 byte, requesting additional bytes beyond the buffer boundary, causing GenericStringStream::Take() to read one byte past the heap allocation.
5. Achieve objective: The application crashes (denial of service), and adjacent heap memory may be returned or observable through error handling paths (information disclosure).

• Network: Unexpected or malformed JSON Schema documents submitted to API endpoints, particularly those containing pattern or patternProperties fields with non-standard or binary-containing regex strings.
• Logs: Application crash logs or core dumps referencing rapidjson::GenericStringStream, stream.h:116, or rapidjson::internal::GenericRegex; AddressSanitizer reports citing heap-buffer-overflow in GenericStringStream<UTF8<char>>::Take().
• Process: Abnormal termination (SIGSEGV, SIGABRT) of processes that perform JSON Schema validation; repeated process restarts of services using RapidJSON for schema validation.
• File System: Presence of core dump files generated by the application process following receipt of crafted input.

No official patched release of RapidJSON has been issued by Tencent as of the disclosure date, and the project had not responded to the issue report (RapidJSON Issue). A patch is referenced via Red Hat Bugzilla (Red Hat Bugzilla), and organizations using Red Hat products should monitor Red Hat security advisories for updates. As an immediate workaround, apply the suggested code fix directly to include/rapidjson/stream.h: add a bounds check in GenericStringStream::Take() — if (src_ >= head_ + length_) return static_cast<Ch>(0); — before the dereference. Additionally, validate and sanitize all user-supplied regex or JSON Schema input before passing it to RapidJSON, and consider disabling JSON Schema pattern validation for untrusted input until an upstream fix is available (Feedly).

The vulnerability was reported by researcher shuidaao via GitHub Issue #2401 on October 11, 2026, with a detailed root cause analysis and PoC; the researcher also clarified that this issue is independent from other concurrently reported RapidJSON vulnerabilities (e.g., Issue #2405) (RapidJSON Issue). The CVE was assigned by VulDB and published to the GitHub Advisory Database and NVD on October 27, 2026 (Github Advisory). No significant vendor statement from Tencent or broad media coverage has been observed as of disclosure.