Description
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.
Published: 2026-10-28
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Local Arbitrary Code Execution
Action: Immediate patch
AI Analysis

Impact

SimulationCraft contains a heap-based buffer overflow in the bcp_api.cpp processing loop that writes beyond the allowed four gem slots into adjacent gem_bonus_id storage. The overrun corrupts internal vector pointers, causing the item destructor to free an attacker‑controlled pointer when the simulation exits, and has been shown to supply arbitrary code execution in a test environment.

Affected Systems

The vulnerability affects SimulationCraft (simc) builds released after release-820-01 and before the May 7, 2026 nightly identified as simc-1205-01-516b5d7. Specific release tags are not yet available, but any build between those points is vulnerable.

Risk and Exploitability

With a CVSS score of 7.5 and no EPSS data, the risk is moderate but significant. The vulnerability is not listed in CISA KEV. Attack inputs can be injected via a malicious .simc profile, a compromised addon export, or altered Battle.net API responses by a network attacker with privileged position. Exploitation requires local execution of SimulationCraft with the crafted input, and results in uncontrolled code execution during cleanup.

Generated by OpenCVE AI on October 28, 2026 at 16:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update SimulationCraft to the nightly build simc-1205-01-516b5d7 or a later release that contains the fix.
  • Run SimulationCraft in a controlled or sandboxed environment to limit the impact of malicious inputs if an update is unavailable.
  • Ensure source files are from trusted origins and restrict network traffic that could modify Battle.net API responses.

Generated by OpenCVE AI on October 28, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.
Title SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
Weaknesses CWE-122
CWE-787
References
Metrics cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T15:38:21.113Z

Reserved: 2026-05-18T22:54:18.271Z

Link: CVE-2026-47235

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T16:17:07.563

Modified: 2026-10-28T16:17:07.563

Link: CVE-2026-47235

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T16:30:15Z

Weaknesses