flatcc CVE-2026-116733

The attacker must be able to supply untrusted JSON that terminates immediately after a decimal point (e.g. a bare '3.') to a flatcc-generated JSON parser; this triggers the one-byte over-read in __flatcc_json_parser_number. The crash only materializes when the input buffer ends exactly at an unmapped memory page (reflected as AT:P in the CVSS 4.0 vector) - otherwise the over-read is benign - so the practical limiting factor is the victim process's memory/allocation layout, which is not fully under attacker control. No authentication or user interaction is required (PR:N, UI:N), and the only impact is availability (process crash); there is no confidentiality or integrity effect. Applicable to flatcc 0 through 0.6.4 using the JSON parser runtime.

This is a genuine but moderate-priority issue, not a high-severity emergency. The CVSS 4.0 base score is 6.3 (medium) with an availability-only impact (VA:L; VC:N, VI:N) - the flaw crashes applications but does not leak data or allow code execution, so the CWE-125 out-of-bounds read is a denial-of-service primitive rather than an information-disclosure one. Signals are internally consistent and point to limited real-world urgency: EPSS is 0.38% (32nd percentile, low), the CVE is NOT in CISA KEV, and the vuln.today decision label is 'this_month' rather than act_now/emergency. The one factor raising realistic exploitability is AV:N/PR:N/UI:N - any application feeding attacker-controlled JSON to a flatcc-generated parser is reachable remotely without authentication. However, the 4.0 vector's AT:P (Attack Requirement: Present) correctly reflects that a crash only occurs when the input buffer happens to end at an unmapped memory page, so exploitation is not fully reliable. A public PoC reference exists (HackMD writeup and VulnCheck advisory) but it is not verified as working exploit code. Note one conflicting signal: the 'Information Disclosure' tag contradicts the CVSS metrics (VC:N) and the description, which states the bug crashes applications - treat this as a DoS, not data disclosure.

An attacker sends untrusted JSON ending immediately after a decimal point (e.g. '3.') to an application that uses a flatcc-generated JSON parser; __flatcc_json_parser_number reads one byte past the end of the input buffer, and when the buffer ends exactly at an unmapped page the process crashes, causing a denial of service. Exploitation is remote and unauthenticated (PR:N) but reliability depends on the victim's memory layout (AT:P). A public PoC reference exists (HackMD analysis, VulnCheck advisory); it is not verified as working exploit code.