CVE-2026-88344: flatcc schema lexer out-of-bounds read

Executive brief

flatcc is a library used to process FlatBuffers schema files. An out-of-bounds read vulnerability in the schema lexer can cause an application to crash when processing a specially crafted schema file that ends with a digit, resulting in denial of service.

Technical details

The integer digit-scan loop in the lex() function fails to check buffer boundaries before dereferencing the input pointer when an exact-length schema buffer ends with a digit character. This results in a one-byte heap buffer over-read (CWE-122). The vulnerability requires processing a maliciously crafted FlatBuffers schema as input; a patch exists that adds a bounds check to the loop condition.

Affected products

• dvidelabs flatcc 4c3b999e and earlier

Timeline

• 2026-09-22: disclosed
• 2026-09-22: patched: Fix committed in c1dcc8e

References

• https://github.com/dvidelabs/flatcc/issues/384
• https://github.com/jimjag/flatcc/commit/c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e