The vulnerability is an out-of-bounds read in the schema lexer of the flatcc library. A schema that ends with an unterminated quotation mark causes the C-string scanning routine in lex() to dereference a pointer beyond the buffer, which can trigger a one-byte heap buffer over-read. This read can lead to a crash of the application that uses flatcc, resulting in a denial of service.

flatcc C/C++ flatbuffer compiler and runtime library; the affected code is identified by the commit hash 4c3b999e. Any application that links against this version of flatcc and parses attacker‑controlled schemas is susceptible.

The CVSS score is 7.5 and the EPSS score is <1%, indicating a very low exploitation probability, but the flaw remains exploitable if an application processes untrusted schemas. An attacker who can supply a malicious schema – via a network service, configuration file, or otherwise – can induce a one‑byte buffer over‑read that leads to a crash. Because the vulnerability is a pure read, it does not provide immediate code execution; however, the resulting denial of service can disrupt services. The issue is not listed in CISA’s KEV catalog, so there are no confirmed exploitation reports, yet its nature and lack of mitigations suggest it could be targeted in environments that use flatcc without proper schema validation.