CVE-2026-90786

Deferred Deferred - Pending Action

Reachable Assertion in flatcc up to 0.6.3

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 8b19ba4e992ebcad7f5970704d1afc5507fa5205. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90786

EUVD

EUVD-2026-77478

Affected Vendors & Products

Vendor	Product	Version / Range
dvidelabs	flatcc	to 0.6.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is a reachable assertion in Dvidelabs flatcc up to 0.6.3. It occurs when a table member is declared twice in a FlatBuffers schema file, causing the align_order_members function in src/compiler/semantics.c to fail with an assertion error (k > 0). This leads to a crash (SIGABRT) during semantic analysis.

Detection Guidance

To detect this vulnerability, check if your system uses Dvidelabs flatcc version 0.6.3 or earlier. Run flatcc --version to verify the installed version. If vulnerable, the compiler may crash when processing FlatBuffers schema files with duplicate member names.

Impact Analysis

This vulnerability can cause a denial-of-service condition by crashing the flatcc schema compiler when processing a schema with duplicate member names. Attackers could exploit this remotely by providing a maliciously crafted schema file to trigger the crash.

Compliance Impact

This vulnerability causes a denial-of-service condition in the flatcc schema compiler due to a reachable assertion failure when duplicate symbols are present. While it does not directly expose or leak data, it could disrupt systems relying on FlatBuffers schema compilation, potentially impacting availability of services handling sensitive data. This may indirectly affect compliance with standards like GDPR (data processing integrity) or HIPAA (service availability for healthcare data) if such disruptions lead to unplanned downtime or data processing failures.

Mitigation Strategies

Apply the patch from commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205. Update flatcc to a patched version. Avoid using FlatBuffers schema files with duplicate member names to prevent crashes during compilation.

Hi! I’m here to help you understand CVE-2026-90786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70