flatcc CVE-2026-88345

Exploitation requires the flatcc schema compiler/lexer (commit 4c3b999e) to parse an attacker-controlled FlatBuffers schema (.fbs) input, and the malicious schema must be exactly the length of the input buffer AND terminate with an unterminated quotation mark so that lex() dereferences the pointer one byte past the buffer end. The key limiting factor is delivery: the attacker must get their crafted schema into a flatcc parse/compile operation (a build step, CI pipeline, or an application embedding the flatcc parser on untrusted schemas), so despite the AV:N rating this is realistically a local/tool-invocation-driven flaw rather than an exposed network service. Impact is limited to a single-process crash (denial of service) with no code execution, data disclosure, or integrity impact.

This is a genuine but low-priority denial-of-service issue whose signals broadly agree once the vector is scrutinized. The NVD CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates it 'High', but that score is driven entirely by A:H combined with a network vector; the actual impact is a single one-byte heap over-read in the flatcc schema lexer (lex() in external/lex/luthor.c) that causes a crash - a one-shot process abort, not a sustainable or amplifiable service outage. The AV:N assignment is questionable: flatcc is a FlatBuffers schema compiler/parser, so exploitation means feeding it a maliciously crafted .fbs schema, which in most deployments is a local build-tool or embedded-parser operation rather than a remote network service. EPSS is low at 0.22% (13th percentile) and there is no CISA KEV listing, consistent with a niche developer tool that is not a mass-exploitation target. SSVC records Exploitation=poc (a fix commit/issue exist, but no evidence of active exploitation), Automatable=yes, and Technical Impact=partial - the 'partial' technical impact aligns with a crash-only DoS and contradicts the A:H-driven 'High' headline. No confidentiality or integrity impact applies (C:N/I:N). Net: a legitimate bug worth patching in build pipelines that parse untrusted schemas, but not an urgent, widely-exploited threat.

An attacker crafts a FlatBuffers schema whose length exactly fills the input buffer and ends with an unterminated quotation mark, then gets a victim to compile or parse it with flatcc (e.g., an untrusted schema pulled into a CI/build step or fed to an application that embeds the flatcc parser). When lex() scans the C-string it dereferences the input pointer one byte past the end of the buffer, triggering a heap over-read and crashing the process. A public issue and fix commit exist (POC-level per SSVC), but there is no evidence of active exploitation.