flatcc EUVD-2026-84853

Exploitation requires that the application feed an attacker-controlled FlatBuffers schema buffer to flatcc's schema lexer (lex() in external/lex/luthor.c) and that the buffer be an exact-length input ending on a digit character - the digit-scan loop then advances one byte past the end marker q. The practical reachability is limited by deployment: flatcc is predominantly a build-time schema compiler, so remote/unauthenticated exploitation only applies if a service compiles or lexes untrusted schema text at runtime; in the common developer/CI usage the input is local. Impact is confined to a one-byte heap over-read causing a process crash - no memory write, no code execution, no data disclosure. Affects flatcc at commit 4c3b999e; fixed by the bounds-check commit c1dcc8e.

This is a memory-safety denial-of-service issue with a bounded, low-severity impact: a specially crafted FlatBuffers schema whose buffer ends on a digit drives the digit-scan loop in lex() one byte past the input, producing a single-byte heap over-read that crashes the process. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) rates it HIGH purely on availability, but that score is optimistic for how flatcc is actually used: flatcc is a build-time FlatBuffers schema compiler/library, so AV:N only holds if an application feeds attacker-controlled schema text to the lexer at runtime (e.g., a service that compiles user-supplied schemas). In the far more common build/developer-tool usage the practical vector is local, which would lower the real-world score substantially. There is no confidentiality or integrity impact - it is a one-byte over-read that reads, not writes, and the fix (++p != q bounds check and a p != q guard before dereferencing *p) confirms it is a read past the end marker q, not a controllable corruption. No EPSS score, no CISA KEV listing, and no public exploit code are provided, though an upstream issue (#384) and a fix commit exist. Net: this is a legitimate bug worth patching but a low real-world priority - a self-crash on malformed input to a niche developer tool, not a remotely weaponizable RCE despite the 7.5 headline. Note also the CWE is misassigned: CWE-22 (Path Traversal) does not describe this defect, which is an out-of-bounds read (CWE-125).

An attacker who can supply a FlatBuffers schema to an application that invokes flatcc's lexer at runtime crafts a schema whose buffer ends exactly on a digit; when the lexer scans the trailing integer it reads one byte past the buffer end, crashing the parsing process. No public exploit code is identified, though an upstream issue and fix commit exist. Impact is limited to a denial of service of the process handling the schema.