EUVD-2026-37865
GHSA-r8v3-j8rv-hmxv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector; victim must compile the crafted file (UI:R); no privileges needed to supply a source file; read-only impact limits C:L and A:L with no integrity effect.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename and line number metadata and later uses it without validation when accessing source line arrays. By supplying invalid or oversized line numbers, an attacker can trigger out-of-bounds memory access and a crash.
Maintainer of this project was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Version corresponding to the commit b480958 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Out-of-bounds read in 8cc, a small C compiler by rui314, allows a local attacker to crash the compiler and potentially disclose compiler process memory by supplying a crafted source file containing malicious #line directives or GNU linemarkers with oversized line numbers. The vulnerability arises because attacker-controlled filename and line number metadata embedded in source files is accepted and used without bounds validation when 8cc accesses internal source line arrays. No patch is available at time of analysis; the maintainer did not respond to CERT-PL's coordinated disclosure. No public exploit identified at time of analysis, though CERT-PL confirmed the vulnerability at commit b480958.
Technical ContextAI
8cc (CPE: cpe:2.3:a:rui314:8cc:*:*:*:*:*:*:*:*) is a self-hosting C compiler targeting x86-64. The C preprocessor specification allows #line directives to override the compiler's internal record of the current source file name and line number - a legitimate feature used by preprocessors and code generators. GNU linemarkers extend this with additional flags. The root cause (CWE-125: Out-of-Bounds Read) is that 8cc stores source lines in an array and uses the attacker-supplied line number value as an index into that array without first validating that the value falls within the array's allocated bounds. Supplying a value larger than the array size causes the compiler to read memory beyond the allocated buffer, triggering a crash and potentially exposing adjacent heap or stack memory contents. The tag 'Buffer Overflow' in the intelligence data is slightly misleading - CWE-125 is a read-only out-of-bounds access, not a write overflow, and thus does not directly enable arbitrary code execution.
RemediationAI
No vendor-released patch identified at time of analysis; the maintainer did not respond to CERT-PL's coordinated disclosure notification. Organizations using 8cc should immediately assess whether it is deployed in environments that compile untrusted or externally supplied C source files. The most effective compensating control is to cease using 8cc for compilation of untrusted input and substitute a maintained compiler such as GCC or Clang, which have active security response processes. If 8cc must remain in use, restrict its execution to sandboxed environments (e.g., containers with seccomp profiles or gVisor) to limit the impact of a crash or memory disclosure. Build pipelines that ingest third-party or user-submitted source code should be isolated from production networks to contain the availability and confidentiality impacts. Monitor https://github.com/rui314/8cc for any upstream commits addressing this issue and review the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-50641 for updates.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today