CVE-2026-47235

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcp_api.cpp loop over the JSON sockets array uses slot_data["sockets"].Size() without bounding gem_idx by MAX_GEM_SLOTS, which is four in engine/sc_enums.hpp. The destination gem_id and gem_bonus_id arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gem_id into the adjacent gem_bonus_id vector storage; bonus_list entries can also access gem_bonus_id out of bounds. Corrupting a vector's _M_start pointer causes the item_t destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcp_api.cpp loop over the JSON sockets array uses slot_data["sockets"].Size() without bounding gem_idx by MAX_GEM_SLOTS, which is four in engine/sc_enums.hpp. The destination gem_id and gem_bonus_id arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gem_id into the adjacent gem_bonus_id vector storage; bonus_list entries can also access gem_bonus_id out of bounds. Corrupting a vector's _M_start pointer causes the item_t destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcp_api.cpp loop over the JSON sockets array uses slot_data["sockets"].Size() without bounding gem_idx by MAX_GEM_SLOTS, which is four in engine/sc_enums.hpp. The destination gem_id and gem_bonus_id arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gem_id into the adjacent gem_bonus_id vector storage; bonus_list entries can also access gem_bonus_id out of bounds. Corrupting a vector's _M_start pointer causes the item_t destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcp_api.cpp loop over the JSON sockets array uses slot_data["sockets"].Size() without bounding gem_idx by MAX_GEM_SLOTS, which is four in engine/sc_enums.hpp. The destination gem_id and gem_bonus_id arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gem_id into the adjacent gem_bonus_id vector storage; bonus_list entries can also access gem_bonus_id out of bounds. Corrupting a vector's _M_start pointer causes the item_t destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.