simdjson 4.6.1 contains a one-byte out-of-bounds read in the parser. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause the iterator to read beyond the input buffer, leading to a heap read and potentially terminating the application. The result is a denial of service for the affected process.

The vulnerability is limited to the simdjson library, specifically release 4.6.1. No additional vendor or product information is provided; any application that integrates this library version at any platform level is potentially impacted.

The vulnerability permits an out-of-bounds read that could crash the target application, but no publicly known exploits and an EPSS score of < 1% are available. The CVSS score of 6.5 indicates medium severity. It is not listed in the CISA KEV catalog. The potential for denial of service remains high if the input data is controllable by an attacker; however, exploitation requires the attacker to deliver a crafted JSON document to the vulnerable parser.