Description
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.
Published: 2026-10-26
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-Bounds Read leading to buffer overread and potential crash
Action: Immediate Patch
AI Analysis

Impact

flatcc through 0.6.4 contains an out-of-bounds read in __flatcc_json_parser_number that lets an attacker read memory beyond the input buffer when parsing numbers that end with a decimal point. The vulnerability can cause application crashes by triggering reads of unmapped memory pages, potentially disrupting service availability. This is a classic CWE‑125 flaw involving out‑of‑bounds read.

Affected Systems

The affected library is flatcc from dvidelabs, version 0.6.4 and earlier, used by applications that incorporate the flatcc_project flatcc project.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is unknown, and the vulnerability is not listed in CISA KEV. Attackers can exercise this flaw by supplying crafted JSON that ends immediately after a decimal point; the attack vector is inferred to be remote if the parser accepts network input, or local if the application runs with elevated privileges.

Generated by OpenCVE AI on October 27, 2026 at 08:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated version of flatcc released after 0.6.4 that removes the out-of-bounds read.
  • If upgrading is temporarily infeasible, validate or reject any JSON that contains a number ending with a decimal point before it reaches the parser to prevent the out-of-bounds read.
  • Ensure that the memory protection mechanisms (e.g., guard pages) are in place to mitigate crashes caused by uninitialized memory access.

Generated by OpenCVE AI on October 27, 2026 at 08:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.
Title flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
First Time appeared Flatcc Project
Flatcc Project flatcc
Weaknesses CWE-125
CPEs cpe:2.3:a:flatcc_project:flatcc:*:*:*:*:*:*:*:*
Vendors & Products Flatcc Project
Flatcc Project flatcc
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Flatcc Project Flatcc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T21:52:34.304Z

Reserved: 2026-10-26T20:23:35.412Z

Link: CVE-2026-116733

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T22:16:57.360

Modified: 2026-10-26T22:16:57.483

Link: CVE-2026-116733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T08:15:15Z

Weaknesses