CVE-2026-90785: Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion
A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyzestruct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f705032346ee39efd7d3848c50b73d455d28d06d. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dvidelabs flatccto a version that resolves this vulnerability.Fixed in 0.6.3Patch f705032346ee39efd7d3848c50b73d455d28d06d
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Dvidelabs flatcc versions up to 0.6.3 are affected. Exposure exists where an attacker can remotely provide input that reaches the compiler's struct-analysis processing.
What does an attacker need to exploit it?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Public exploit information is available.
What is the likely impact?
Successful exploitation can trigger a reachable assertion, resulting in a low-severity availability impact. The provided scoring indicates no confidentiality or integrity impact.
What should teams do if they are affected?
Apply the patch identified as f705032346ee39efd7d3848c50b73d455d28d06d. If patching cannot be done immediately, restrict untrusted remote input from reaching flatcc struct-analysis processing.