AIKIDO-2026-237202

TL;DR

simd-json parses JSON structure with unsafe native and NEON SIMD stage-1 code. The NEON stage-1 path stores structural indexes with an alignment-assuming write into an under-aligned buffer, causing undefined behavior that can corrupt memory, and on runtime-detection builds without the portable feature the native fallback skips UTF-8 validation and treats invalid UTF-8 as a valid string. A zero-length buffer allocation also invokes undefined behavior. The fix switches to unaligned writes, adds a native UTF-8 pre-validation step before structural-bit detection, and avoids the zero-size allocation.