A malformed #line directive or GNU line marker in source files allows the 8cc compiler to perform an out‑of‑bounds read. By providing an attacker‑controlled filename and an excessively large line number, the compiler later indexes into its source line array without bounds checking, resulting in a crash. The vulnerability does not provide a code execution path or data disclosure.

The vulnerability is limited to the 8cc compiler distributed by rui314. The commit identified as vulnerable is b480958, and while no formal version range is published, any compile that processes #line directives and the GNU linemarkers feature may be affected.

The CVSS score of 5.1 places the issue in the medium severity range, and the EPSS score of fewer than one percent indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a specially crafted source file during compilation; impact is limited to the compilation environment and results in a denial of service by terminating the compiler.