Is CVE-2026-90786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90786 being exploited in the wild.

How severe is CVE-2026-90786?

Medium severity, with a CVSS score of 5.3, published 14 September 2026.

Is there a fix for CVE-2026-90786?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90786 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90786?

Check whether you run Dvidelabs Flatcc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90786: Dvidelabs flatcc reachable assertion in align_order_members

CVE-2026-90786 · Severity: medium · CVSS 5.3 · Published 2026-09-14

flatcc is a FlatBuffers compiler for C that translates schema files into C code. When a user accidentally declares the same table member twice in a schema file, the compiler crashes with an assertion error instead of reporting a proper syntax error. This denial-of-service vulnerability could disrupt development workflows and CI/CD pipelines that rely on flatcc for code generation.

Technologies: Dvidelabs Flatcc. Vendors: Dvidelabs.

Quick answers

Is CVE-2026-90786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90786 being exploited in the wild.
How severe is CVE-2026-90786?: Medium severity, with a CVSS score of 5.3, published 14 September 2026.
Which products and versions are affected?: Dvidelabs Flatcc up to 0.6.3.
Is there a fix for CVE-2026-90786?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90786 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90786?: Check whether you run Dvidelabs Flatcc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reachable assertion (CWE-617) in the align_order_members() function at src/compiler/semantics.c:1059. When a table member is declared twice, the duplicate entry's computed sort_key value collapses to 0, triggering the assertion `assert(k > 0)` and aborting the compiler with SIGABRT. The root cause is insufficient validation during semantic analysis; duplicate member names should be caught as redefinition errors before the ordering phase. The attack vector is attacker-controlled .fbs schema text, requiring no authentication or network access. A fix is available in commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205.

Affected products

Dvidelabs flatcc up to 0.6.3

Timeline

2026-09-14: disclosed
2026-08-04: other: Bug report filed on GitHub issue #387
other: Patch available: commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.