CVE-2026-88345: flatcc schema lexer out-of-bounds read in string parsing

Executive brief

flatcc is a FlatBuffers schema compiler. When processing a maliciously crafted schema file with an unterminated quotation mark at the end of the input, the lexer's string scanning logic reads one byte past the end of the input buffer. An attacker can trigger this vulnerability by submitting a specially crafted schema, causing the application to crash.

Technical details

The vulnerability is an out-of-bounds read (CWE-122) in the lex() function's C-string scanning logic. When a schema reaches its end while inside an unterminated string literal, the pointer dereference (*p) occurs after p has exceeded the buffer boundary. A specially crafted schema can trigger this one-byte heap buffer over-read, resulting in denial of service through application crash.

Affected products

• dvidelabs flatcc before 8581715e8ec4e5de8eea9fd6dad949e4dd7d0fa0

Timeline

• 2026-09-22: disclosed
• 2026-09-22: patched: commit 8581715e8ec4e5de8eea9fd6dad949e4dd7d0fa0

References

• https://github.com/dvidelabs/flatcc/issues/385
• https://github.com/jimjag/flatcc/commit/8581715e8ec4e5de8eea9fd6dad949e4dd7d0fa0