{"schema":"threatline.record/2","record":{"id":"CVE-2026-47235","aliases":["GHSA-wc9c-hfh3-phxx"],"summary":"SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array","details":"SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data[\"sockets\"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.","categories":["Unclassified"],"product":"simc","vendor":"simulationcraft","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-47235","source_modified_at":"2026-10-28T15:38:21.113Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"simc","vendor":"simulationcraft","versions":[{"version":"< aff85992d284ca4621e784c6b065a271b22f629d","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T15:38:21.113Z","modified_at":"2026-10-28T15:38:21.113Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-47235","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T15:38:21.113Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/simulationcraft/simc/security/advisories/GHSA-wc9c-hfh3-phxx","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/simulationcraft/simc/commit/aff85992d284ca4621e784c6b065a271b22f629d","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T15:38:21.113Z","content_hash":"999fefcc1d35ac1cd60a05ee91ca1b2c42340e2905673263e624d26e118bd44e"}}