CVE-2026-116733

LOW 3.7

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

CWE	CWE-125
Vendor	dvidelabs
Product	flatcc
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for dvidelabs flatcc

Be the first to know when new low vulnerabilities affecting dvidelabs flatcc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

dvidelabs / flatcc

0 ≤ 0.6.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dvidelabs/flatcc/commit/356792dc155a9e685acdfe0ec1e209bdadcb4ab9 github.com: https://github.com/dvidelabs/flatcc github.com: https://github.com/dvidelabs/flatcc/blob/v0.6.4/src/runtime/json_parser.c#L539-L543 hackmd.io: https://hackmd.io/@haindpwn/flatcc-json-number-oob-read vulncheck.com: https://www.vulncheck.com/advisories/flatcc-through-0.6.4-out-of-bounds-read-via-flatcc-json-parser-number

Credits

HaiND from the Post and Telecommunication Institute of Technology mikkelfj