---
id: CVE-2026-47235
title: >-
  SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in
  SimulationCraft's gem_id Array
summary: >-
  SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In
  builds after release-820-01 and before the identified May 7, 2026 nightly, the
  `bcp_api.cpp` loop over the JSON `sockets` array uses
  `slot_data["sockets"].Siz…
severity: high
cvss: 7.5
cvssVector: 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-122
  - CWE-787
vendor: simulationcraft
product: simc
affected:
  - simc < aff85992d284ca4621e784c6b065a271b22f629d
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T18:38:11.836574Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T18:38:47.642Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-47235'
references:
  - url: >-
      https://github.com/simulationcraft/simc/security/advisories/GHSA-wc9c-hfh3-phxx
    label: >-
      https://github.com/simulationcraft/simc/security/advisories/GHSA-wc9c-hfh3-phxx
  - url: >-
      https://github.com/simulationcraft/simc/commit/aff85992d284ca4621e784c6b065a271b22f629d
    label: >-
      https://github.com/simulationcraft/simc/commit/aff85992d284ca4621e784c6b065a271b22f629d
tags:
  - cve.org
  - exploit-available
epss: 0.00153
epssPercentile: 0.04467
ingestedAt: '2026-10-28T16:13:50.583Z'
---

## Overview

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.

## Affected

- `simc < aff85992d284ca4621e784c6b065a271b22f629d`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.