CVE-2026-88345
Received Received - Intake

Out-of-Bounds Read in FlatCC Schema Lexer

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description
An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after it has reached the end of the buffer. A specially crafted schema can trigger a one-byte heap buffer over-read, resulting in application crash and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-88345
EUVD
EUVD-2026-84852

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flatcc flatcc From 4c3b999e3c0a423f9fd8df3c9e58ba9d2069d71b (inc)
flatcc flatcc 4c3b999e

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the schema lexer of flatcc. It occurs when a FlatBuffers schema with an exact length ends with an unterminated quotation mark. The C-string scanning logic incorrectly dereferences the input pointer after reaching the buffer's end, causing a one-byte heap buffer over-read. This leads to application crashes and denial of service.

Detection Guidance

To detect this vulnerability, inspect flatcc library versions in use. Check for flatcc HEAD commit 4c3b999e3c0a423f9fd8df3c9e58ba9d2069d71b (v0.6.4-pre). Use static analysis tools to review lex() function logic for guard-after-dereference issues. Test with a proof-of-concept schema containing an unterminated trailing quote to trigger AddressSanitizer errors.

Impact Analysis

This vulnerability can cause your application to crash or become unresponsive, leading to denial of service. If exploited, it may allow attackers to read sensitive memory, potentially exposing data or enabling further attacks.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or unauthorized data access, which may violate availability and security requirements in GDPR, HIPAA, and other regulations. Ensuring system stability and data protection is critical to maintain compliance.

Mitigation Strategies

Immediately upgrade flatcc to a patched version where the lex() function's pointer checks are reordered to prevent buffer over-reads. If upgrading is not possible, apply input validation to reject schemas with unterminated quotes. Monitor applications using flatcc for crashes or memory corruption errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart