SimulationCraft is a tool to explore combat mechanics in World of Warcraft.
CVE-2026-47235
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata["sockets"].Size() without bounding gemidx by MAXGEMSLOTS, which is four in engine/scenums.hpp. The destination gemid and gembonusid arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gemid into the adjacent gembonusid vector storage; bonuslist entries can also access gembonusid out of bounds. Corrupting a vector's Mstart pointer causes the itemt destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.
Assessment
- CVSS
- 7.5 (v4.0)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 29 October 2026
- Weakness
- CWE-122, CWE-787
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-47235