CVE-2026-90786: Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion
A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function alignordermembers of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 8b19ba4e992ebcad7f5970704d1afc5507fa5205. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dvidelabs flatccto a version that resolves this vulnerability.Fixed in 0.6.3Patch 8b19ba4e992ebcad7f5970704d1afc5507fa5205
Event History
Frequently Asked Questions
Which deployments are affected?
Dvidelabs flatcc versions up to and including 0.6.3 are affected. The issue is in the Duplicate Symbol Handler, specifically the align_order_members function in src/compiler/semantics.c.
Can this be exploited remotely without authentication or user interaction?
Yes. The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction; the description also states that the attack can be initiated remotely.
What is the likely impact of successful exploitation?
Successful manipulation causes a reachable assertion, resulting in an availability impact. The provided vector indicates no confidentiality or integrity impact and a low availability impact.
What should be done if the affected version is in use?
Deploy the patch identified as 8b19ba4e992ebcad7f5970704d1afc5507fa5205. Public exploit disclosure is noted, so remediation should be prioritized.