Executive brief
8cc is a small C compiler. A vulnerability exists where the compiler incorrectly handles specific metadata directives (line markers) within source code. If a user is tricked into compiling a specially crafted file, the compiler could crash or leak small amounts of memory information, potentially disrupting development workflows.
Technical details
An Out-of-Bounds (OOB) Read vulnerability exists in the 8cc C compiler due to insufficient validation of #line directives and GNU-style linemarkers. The root cause is located in the preprocessor/lexer logic where attacker-supplied line number metadata is used as an index into source line arrays without bounds checking. A local attacker can provide a crafted C source file with oversized or invalid line numbers to trigger an OOB read. This results in a denial-of-service (crash) or potential disclosure of memory contents. Commit b480958 is confirmed vulnerable; no official patch has been confirmed by the maintainer.
Affected products
- rui314 8cc commit b480958
Timeline
- 2026-06-18: advisory: NVD publication date