Executive brief
FlatCC is a FlatBuffers compiler and library written in C. A vulnerability in the struct analysis component can be triggered by processing certain input, leading to a reachable assertion that crashes the compiler. This could disrupt build pipelines and prevent legitimate schema compilation.
Technical details
The vulnerability is a reachable assertion in the analyze_struct function of src/compiler/semantics.c in FlatCC's struct analysis component. The root cause involves improper handling of recursive struct definitions—when circular references in structs are detected, the code continues processing and triggers an assertion instead of gracefully handling the recursion. The attack is remotely exploitable by providing a malicious FlatBuffers schema file to the compiler. An attacker can crash the compiler, resulting in denial of service. A patch (commit f705032) addresses this by adding checks to avoid processing structs recursively when recursion has already been detected.
Affected products
- Dvidelabs flatcc up to 0.6.3
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: patch commit f705032346ee39efd7d3848c50b73d455d28d06d