The vulnerability resides in the GenericStringStream<UTF8<char>>::Take function within RapidJSON’s Regex Parser, where an out-of-bounds read can occur during processing of user-provided data. This flaw allows an attacker to read data from memory locations beyond the intended buffer boundaries, potentially exposing sensitive information. Because the attack can be started remotely, any system that processes untrusted JSON input with RapidJSON is susceptible. No evidence suggests that the read could be leveraged for remote code execution, but the leakage of arbitrary data may aid further exploitation.

Tencent RapidJSON versions up to and including 1.1.0 are affected. The library is widely used in C++ projects that parse JSON, so environments that depend on RapidJSON for input parsing must verify the library version. Any application incorporating the unpatched Regex Parser component is at risk; newer or patched releases of RapidJSON are not known to be affected.

The CVSS score of 6.9 reflects a medium severity, indicating that while the vulnerability does not directly compromise confidentiality at a high level, it remains significant. The EPSS score is not reported, and the issue is not listed in the CISA KEV catalog, although the exploit is publicly disclosed. Based on the description, the likely attack vector is remote exploitation through crafted JSON or regex input sent to an application using RapidJSON. An attacker who can deliver malicious input would trigger the out-of-bounds read and access unintended memory content.