CVE-2026-88345: FlatCC flatcc vulnerability
An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after it has reached the end of the buffer. A specially crafted schema can trigger a one-byte heap buffer over-read, resulting in application crash and denial of service.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the issue?
The application must pass the schema lexer an exact-length FlatBuffers schema whose final quotation mark is unterminated. The malformed schema causes lex() to read one byte beyond the input buffer.
What is the practical impact?
A crafted schema can cause an application crash, resulting in denial of service. The provided data describes a one-byte heap buffer over-read and does not establish further impact.
How can I determine whether an application is exposed?
Applications are exposed where they invoke FlatCC's schema lexer on FlatBuffers schema input that could be malformed, particularly input supplied by untrusted users or external systems. The issue affects the referenced FlatCC revision 4c3b999e.