Buffer Overflow Vulnerability in SimulationCraft Tool by Blizzard

CVE-2026-47235

What is CVE-2026-47235?

A buffer overflow vulnerability exists in the SimulationCraft tool, which is used to explore combat mechanics in World of Warcraft. The issue arises in versions after the release-820-01 and before a nightly build on May 7, 2026. Specifically, the vulnerability occurs in the bcp_api.cpp file, where the loop iterates over the JSON sockets array without appropriately bounding gem_idx by the maximum allowable slots. As a result, writing beyond the intended memory limits can corrupt adjacent data structures, leading to crashes and the potential for remote code execution. Attack vectors include malicious .simc profiles or manipulated responses from the Battle.net API. The vulnerability is addressed in the nightly build identified as simc-1205-01-516b5d7.

References