An out‑of‑bounds read occurs in the schema lexer of flatcc when an exact‑length FlatBuffers schema buffer ends with a digit. The lexer’s integer scan loop incorrectly advances past the buffer boundary and dereferences an invalid pointer, causing a one‑byte heap over‑read. This flaw leads to an application crash and denial of service but does not grant code execution or information disclosure.

The issue appears in the flatcc library at commit 4c3b999e and any derivative builds that have not been updated to the fix committed as c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e. No vendor or product names were supplied, so any software that links against this specific flatcc revision is potentially impacted.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a low publicly known exploitation probability. The likely attack vector is the delivery of a malicious schema buffer to an application, which could be local or remote depending on how schemas are accepted. An attacker would need write access to the target system or the ability to supply a schema to trigger the crash; no remote code execution is possible.