An integer overflow in FlatCC’s verifier check_header allows attackers to build a crafted buffer offset that wraps the bounds check on 32‑bit builds. The overflow causes the verifier to read beyond the start of the buffer, leading to an out‑of‑bounds read and a crash of the process. No direct code execution is achieved, but the effect is a denial of service.

The vulnerability affects the FlatCC library from dvidelabs, specifically versions up to and including 0.6.4. Any deployment that links against or otherwise utilizes flatcc 0.6.4 or earlier is at risk.

The CVSS score of 6.3 indicates a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The flaw requires crafted input to the verifier and is limited to 32‑bit builds, meaning that an attacker would need either local or remote access to supply malicious data to the vulnerable component. While the attack does not provide remote code execution, the resulting crash could be leveraged in a broader denial‑of‑service campaign.