# CVE-2026-90786: Dvidelabs flatcc reachable assertion in align_order_members

Source: https://junglewise.ai/threats/cve-2026-90786-dvidelabs-flatcc-reachable-assertion-in-align-order-members  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90786 · Severity: medium · CVSS 5.3 · Published 2026-09-14

flatcc is a FlatBuffers compiler for C that translates schema files into C code. When a user accidentally declares the same table member twice in a schema file, the compiler crashes with an assertion error instead of reporting a proper syntax error. This denial-of-service vulnerability could disrupt development workflows and CI/CD pipelines that rely on flatcc for code generation.

Technologies: [Dvidelabs Flatcc](https://junglewise.ai/threats/technologies/flatcc). Vendors: [Dvidelabs](https://junglewise.ai/threats/vendors/dvidelabs).

## Quick answers

**Is CVE-2026-90786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90786 being exploited in the wild.

**How severe is CVE-2026-90786?** Medium severity, with a CVSS score of 5.3, published 14 September 2026.

**Which products and versions are affected?** Dvidelabs Flatcc up to 0.6.3.

**Is there a fix for CVE-2026-90786?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90786 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90786?** Check whether you run Dvidelabs Flatcc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reachable assertion (CWE-617) in the align_order_members() function at src/compiler/semantics.c:1059. When a table member is declared twice, the duplicate entry's computed sort_key value collapses to 0, triggering the assertion `assert(k > 0)` and aborting the compiler with SIGABRT. The root cause is insufficient validation during semantic analysis; duplicate member names should be caught as redefinition errors before the ordering phase. The attack vector is attacker-controlled .fbs schema text, requiring no authentication or network access. A fix is available in commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205.

## Affected products

- Dvidelabs flatcc up to 0.6.3

## Timeline

- 2026-09-14: disclosed
- 2026-08-04: other: Bug report filed on GitHub issue #387
- other: Patch available: commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205

## References

- [https://github.com/dvidelabs/flatcc/](https://github.com/dvidelabs/flatcc/)
- [https://github.com/dvidelabs/flatcc/issues/387](https://github.com/dvidelabs/flatcc/issues/387)

## Related threats

- [flatcc schema lexer out-of-bounds read in string parsing](https://junglewise.ai/threats/cve-2026-88345-an-out-of-bounds-read-vulnerability-exists-in-the-schema-lexer-of)
- [flatcc schema lexer out-of-bounds read](https://junglewise.ai/threats/cve-2026-88344-an-out-of-bounds-read-vulnerability-exists-in-the-schema-lexer-of)
- [Dvidelabs flatcc reachable assertion in struct analysis](https://junglewise.ai/threats/cve-2026-90785-dvidelabs-flatcc-reachable-assertion-in-struct-analysis)
- [Dvidelabs flatcc memory leak in fb_clear_parser](https://junglewise.ai/threats/cve-2026-90784-dvidelabs-flatcc-memory-leak-in-fb-clear-parser)