# CVE-2026-88344: flatcc schema lexer out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-88344-an-out-of-bounds-read-vulnerability-exists-in-the-schema-lexer-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88344 · Severity: high · CVSS 7.5 · Published 2026-09-22

flatcc is a library used to process FlatBuffers schema files. An out-of-bounds read vulnerability in the schema lexer can cause an application to crash when processing a specially crafted schema file that ends with a digit, resulting in denial of service.

Technologies: [Dvidelabs Flatcc](https://junglewise.ai/threats/technologies/flatcc). Vendors: [Dvidelabs](https://junglewise.ai/threats/vendors/dvidelabs).

## Quick answers

**Is CVE-2026-88344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88344 being exploited in the wild.

**How severe is CVE-2026-88344?** High severity, with a CVSS score of 7.5, published 22 September 2026.

**Which products and versions are affected?** Dvidelabs Flatcc 4c3b999e and earlier.

**Is there a fix for CVE-2026-88344?** A patch was published on 2026-09-22: Fix committed in c1dcc8e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88344 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88344?** Check whether you run Dvidelabs Flatcc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The integer digit-scan loop in the lex() function fails to check buffer boundaries before dereferencing the input pointer when an exact-length schema buffer ends with a digit character. This results in a one-byte heap buffer over-read (CWE-122). The vulnerability requires processing a maliciously crafted FlatBuffers schema as input; a patch exists that adds a bounds check to the loop condition.

## Affected products

- dvidelabs flatcc 4c3b999e and earlier

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fix committed in c1dcc8e

## References

- [https://github.com/dvidelabs/flatcc/issues/384](https://github.com/dvidelabs/flatcc/issues/384)
- [https://github.com/jimjag/flatcc/commit/c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e](https://github.com/jimjag/flatcc/commit/c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e)

## Related threats

- [flatcc schema lexer out-of-bounds read in string parsing](https://junglewise.ai/threats/cve-2026-88345-an-out-of-bounds-read-vulnerability-exists-in-the-schema-lexer-of)
- [Dvidelabs flatcc reachable assertion in align_order_members](https://junglewise.ai/threats/cve-2026-90786-dvidelabs-flatcc-reachable-assertion-in-align-order-members)
- [Dvidelabs flatcc reachable assertion in struct analysis](https://junglewise.ai/threats/cve-2026-90785-dvidelabs-flatcc-reachable-assertion-in-struct-analysis)
- [Dvidelabs flatcc memory leak in fb_clear_parser](https://junglewise.ai/threats/cve-2026-90784-dvidelabs-flatcc-memory-leak-in-fb-clear-parser)