EUVD-2026-77466
GHSA-7xqv-gc79-6hf3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges or interaction needed; only availability impacted (gradual memory leak), no confidentiality or integrity consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8dbc3419738da066151991fd2bf1d0c85591dea2. It is suggested to install a patch to address this issue.
AnalysisAI
Memory leak in the flatcc FlatBuffers C compiler (versions 0.6.0-0.6.3) allows remote attackers to exhaust process memory by supplying crafted schema input that triggers repeated calls to fb_clear_parser() without releasing the keyword_index hash table in the root schema instance. The specific omission - the missing fb_name_table_clear() call on P->schema.root_schema_instance.keyword_index - is confirmed by the patch commit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is triggered whenever an application calls fb_clear_parser() on a parser instance that has processed schema input containing keyword index entries - which is the normal execution path for any flatcc schema compilation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) and the 5.5 score are broadly consistent with a remotely triggerable, unauthenticated memory leak that produces only low availability impact - a gradual, resource-exhaustion DoS rather than an immediate crash or code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by upgrading to a version of flatcc that incorporates commit 8dbc3419738da066151991fd2bf1d0c85591dea2, which adds fb_name_table_clear(&P->schema.root_schema_instance.keyword_index) to fb_clear_parser(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-401 – Memory Leak
View allShare
External POC / Exploit Code
Leaving vuln.today