CVE-2026-50643

Out‑of‑Bounds Read in 8cc

Published Jun 18, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename and line number metadata and later uses it without validation when accessing source line arrays.
By supplying invalid or oversized line numbers, an attacker can trigger out-of-bounds memory access and a crash.

Maintainer of this project was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Version corresponding to the commit b480958 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Analysis

Technical impact

A malformed #line directive or GNU line marker in source files allows the 8cc compiler to perform an out‑of‑bounds read. By providing an attacker‑controlled filename and an excessively large line number, the compiler later indexes into its source line array without bounds checking, resulting in a crash. The vulnerability does not provide a code execution path or data disclosure.

Affected Systems

The vulnerability is limited to the 8cc compiler distributed by rui314. The commit identified as vulnerable is b480958, and while no formal version range is published, any compile that processes #line directives and the GNU linemarkers feature may be affected.

Risk and Exploitability

The CVSS score of 5.1 places the issue in the medium severity range, and the EPSS score of fewer than one percent indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a specially crafted source file during compilation; impact is limited to the compilation environment and results in a denial of service by terminating the compiler.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rui314

8cc

unknown

Version	Status	Constraints
`b480958`	affected	—

No data.

Vendor Product Versions

Rui314

8cc

Version	Status	Scheme	Platform
`b480958`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check whether your 8cc version corresponds to the vulnerable commit or newer; obtain and apply any vendor‑issued patch if available.
If no patch exists, avoid using #line directives or other GNU linemarkers in source files that are compiled with this version of 8cc.
Monitor vendor advisories and the project’s repository for an official fix, and plan to upgrade once it becomes available.

Generated by OpenCVE AI on June 18, 2026 at 19:05 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.138% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert.pl/en/posts/2026/06/CVE-2026-50641
https://github.com/rui314/8cc

History

Jun 21, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rui314 Rui314 8cc
Vendors & Products		Rui314 Rui314 8cc

Jun 18, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename and line number metadata and later uses it without validation when accessing source line arrays. By supplying invalid or oversized line numbers, an attacker can trigger out-of-bounds memory access and a crash. Maintainer of this project was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Version corresponding to the commit b480958 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Title		Out‑of‑Bounds Read in 8cc
Weaknesses		CWE-125
References		https://cert.pl/en/posts/2026/06/CVE-2026-50641 https://github.com/rui314/8cc
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`