CVE-2026-116734
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
dvidelabs flatcc
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.
Text from CVE List
Affected versions 1
- flatccaffected: all versions through 0.6.4CVE List
References 5
- github.com/dvidelabs/flatcc/commit/0df9c097a19badc8bd22d93af8fd47bd291e5d9fFixvia CVE List
- hackmd.io/@haindpwn/flatcc-json-number-oob-readAdvisoryvia CVE List
- vulncheck.com/advisories/flatcc-through-0.6.4-out-of-bounds-read-via-verifier-check-headerAdvisoryvia CVE List
- github.com/dvidelabs/flatccReferencevia CVE List
- github.com/dvidelabs/flatcc/blob/v0.6.4/src/runtime/verifier.c#L126-L137Referencevia CVE List