CVE-2026-116734 in flatcc
Summary
by MITRE • 10/26/2026
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The flatcc library, specifically through version 0.6.4, contains a critical integer overflow vulnerability within its FlatBuffers verification logic. This flaw resides in the check_header function, which is responsible for validating the structural integrity of serialized data before it is processed by applications relying on this schema-based serialization format. The core technical issue stems from an ineffective bounds checking mechanism where the code attempts to prevent buffer overflows but fails due to a dead code path that does not properly account for integer arithmetic limits. In 32-bit build environments, the vulnerability manifests when attackers supply crafted buffer offsets that exploit standard signed or unsigned integer wraparound behavior. Because the overflow guard is effectively non-functional, these malicious inputs cause the calculated memory address to wrap around from a high positive value to a low negative or small positive value, bypassing the intended safety checks designed to keep access within valid memory boundaries.
This architectural flaw leads directly to an out-of-bounds read condition prior to the start of the allocated buffer region. When the verifier processes this malformed input, it attempts to dereference a pointer that points outside the legitimate data segment, typically into unmapped or protected memory areas preceding the buffer allocation. The immediate operational impact is a denial of service, as the process will almost invariably crash due to an access violation or segmentation fault. While out-of-bounds reads are sometimes associated with information disclosure vulnerabilities where sensitive memory contents might be leaked, in this specific context involving header verification and typical FlatBuffers usage patterns, the primary risk remains system instability and application crashes rather than direct data exfiltration. However, depending on how the surrounding code handles subsequent operations after such a crash or if side channels are present, secondary risks cannot be entirely ruled out without deeper static analysis of the host application's error handling routines.
From a classification perspective, this vulnerability aligns with CWE-190, which describes integer overflow or wraparound resulting in an incorrect value that can lead to unexpected behavior such as buffer overflows or logic errors. Furthermore, it maps to MITRE ATT&CK technique T1203, specifically the exploitation of software vulnerabilities for denial-of-service purposes. Attackers leveraging this flaw do not need complex exploit chains; a single crafted FlatBuffers message is sufficient to trigger the crash, making it an attractive target for automated fuzzing campaigns or targeted disruption attacks against services that parse untrusted serialized data.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The most effective remediation is upgrading flatcc to version 0.6.5 or later, where the developers have addressed this specific integer overflow issue by correcting the bounds checking logic in the check_header function. For organizations unable to upgrade immediately due to dependency constraints, implementing input validation at the application layer can provide a temporary buffer against exploitation. This involves verifying that all incoming FlatBuffers payloads adhere strictly to expected size limits and structural constraints before passing them to the library for verification. Additionally, developers should consider enabling compiler flags such as -ftrapv on GCC or Clang which trigger traps on signed integer overflow, although this is not a substitute for fixing the underlying logic error in the source code itself. Regular security audits focusing on arithmetic operations involving user-controlled inputs are essential to prevent similar vulnerabilities from being introduced during future development cycles.