CVE-2026-90785

Deferred Deferred - Pending Action

Reachable Assertion in FlatCC Struct Analysis

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f705032346ee39efd7d3848c50b73d455d28d06d. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90785

EUVD

EUVD-2026-77470

Affected Vendors & Products

Vendor	Product	Version / Range
dvidelabs	flatcc	to 0.6.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is a reachable assertion in the Dvidelabs flatcc compiler up to version 0.6.3. It occurs in the analyze_struct function when processing circular struct references. The parser does not validate that structs form a Directed Acyclic Graph, allowing mutually-recursive structs to trigger an assertion failure in src/compiler/semantics.c. This causes a SIGABRT crash, leading to a denial-of-service condition for the schema compiler.

Detection Guidance

This vulnerability is specific to the flatcc compiler and requires crafted schema files to trigger. Detection involves checking for flatcc versions up to 0.6.3 and analyzing schema files for circular struct references. Use commands like 'flatcc --version' to check the version and 'grep -r "struct.*{" your_schema.fbs' to inspect for potential circular references.

Impact Analysis

An attacker could exploit this by providing a crafted schema file with circular struct references. This would cause the flatcc compiler to crash, disrupting schema compilation processes. The impact is primarily a denial-of-service, as the compiler would fail to process valid schemas.

Compliance Impact

This vulnerability causes a denial-of-service condition in the FlatBuffers compiler when processing crafted schema files with circular struct references. While it does not directly expose data or violate confidentiality, it could disrupt systems relying on FlatBuffers for data serialization, potentially impacting availability. For compliance, this may affect HIPAA's availability requirements if systems fail to process critical data, but it does not directly violate GDPR's data protection principles since no data exposure occurs.

Mitigation Strategies

Apply the patch from commit f705032346ee39efd7d3848c50b73d455d28d06d. Update flatcc to a version that includes the fix. Avoid processing untrusted schema files until patched. Monitor for crashes in the flatcc compiler when handling schema files.

Hi! I’m here to help you understand CVE-2026-90785. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70