Quick answers
- Is CVE-2026-90785 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90785 being exploited in the wild.
- How severe is CVE-2026-90785?
- Medium severity, with a CVSS score of 5.3, published 14 September 2026.
- Which products and versions are affected?
- Dvidelabs Flatcc up to 0.6.3.
- Is there a fix for CVE-2026-90785?
- A patch was published on 2026-09-14: patch commit f705032346ee39efd7d3848c50b73d455d28d06d Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-90785 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-90785?
- Check whether you run Dvidelabs Flatcc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reachable assertion in the analyze_struct function of src/compiler/semantics.c in FlatCC's struct analysis component. The root cause involves improper handling of recursive struct definitions—when circular references in structs are detected, the code continues processing and triggers an assertion instead of gracefully handling the recursion. The attack is remotely exploitable by providing a malicious FlatBuffers schema file to the compiler. An attacker can crash the compiler, resulting in denial of service. A patch (commit f705032) addresses this by adding checks to avoid processing structs recursively when recursion has already been detected.
Affected products
- Dvidelabs flatcc up to 0.6.3
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: patch commit f705032346ee39efd7d3848c50b73d455d28d06d