flatcc CVE-2026-116734

Exploitation requires two concrete conditions: (1) the target application must be compiled as a 32-bit build of flatcc, because the integer overflow in check_header relies on uoffset_t arithmetic wrapping that does not occur on 64-bit builds; and (2) the application must pass an attacker-supplied FlatBuffers buffer through the flatcc verifier (check_header path). The overflow guard was ineffective because its condition uoffset_size <= voffset_size is always false (uoffset is 4 bytes, voffset 2 bytes), making the check dead code. Limiting factors that reduce realistic exposure: 64-bit deployments are not affected at all, and any application that does not run the verifier on untrusted input is not exposed. Impact is limited to a process crash (no code execution or data disclosure per the available evidence).

This is a genuinely moderate-to-low priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 4.0 vector (6.3, Medium) shows AV:N but AT:P and an impact profile of VA:L with VC:N/VI:N - meaning the only consequence is partial availability loss (a process crash), with no confidentiality or integrity impact. This aligns with the description: an out-of-bounds read before the buffer that crashes the process, i.e. a denial-of-service, not an information-disclosure bug despite the word 'read'. EPSS is low at 0.38% (32nd percentile), SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and the vuln is NOT in CISA KEV, so there is no evidence of active exploitation. A public PoC reference exists (the hackmd write-up and VulnCheck advisory); it is not verified as working exploit code, so PoC availability must not be conflated with active exploitation. The decision label is this_month, not act_now/emergency. A key limiting factor the raw score understates: the overflow only manifests on 32-bit builds (reflected as AT:P), so 64-bit deployments are not exposed - this substantially narrows real-world risk.

A service built against 32-bit flatcc that runs the FlatBuffers verifier on untrusted input (for example a network daemon parsing serialized messages) receives a buffer whose offset is crafted to wrap the arithmetic in check_header. Because the overflow guard is dead code, the bounds check is bypassed, an out-of-bounds read occurs before the buffer, and the process crashes, producing a denial of service. A public PoC reference exists (hackmd write-up); it is not verified as working exploit code.