CVE-2026-88345 in Flatcc
Summary
by MITRE • 09/22/2026
An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after it has reached the end of the buffer. A specially crafted schema can trigger a one-byte heap buffer over-read, resulting in application crash and denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified as CVE-2024-XXXXX resides within the lexical analysis component of flatcc version 4c3b999e, specifically affecting the schema lexer responsible for parsing FlatBuffers definition files. This implementation flaw is classified under CWE-125, which denotes an out-of-bounds read vulnerability where a program reads data from memory locations beyond the intended buffer boundaries. The root cause lies in the C-string scanning logic implemented within the lex function, which fails to perform adequate boundary checks when processing string literals that are not properly terminated by closing quotation marks. In standard lexical analysis for schema languages like FlatBuffers, strings must be enclosed in matching quotes; however, this implementation assumes valid input structure and does not account for malformed or truncated inputs where a quote is opened but never closed before the end of the file.
When an attacker provides a specially crafted FlatBuffers schema that contains an exact-length definition ending with an unterminated quotation mark, the lexer attempts to scan characters until it finds the closing delimiter. Because the input buffer ends prematurely without providing this delimiter, the internal pointer used for character iteration advances past the allocated memory region of the input data. This results in a one-byte heap buffer over-read as the code dereferences memory immediately following the valid buffer allocation. While the scope of the read is limited to a single byte, the act of accessing unauthorized memory constitutes a significant security violation and can lead to unpredictable behavior depending on what data resides at that adjacent memory location.
The operational impact of this vulnerability primarily manifests as a denial of service condition due to application crashes. When the out-of-bounds access occurs in a context where it violates memory protection boundaries or accesses unmapped pages, the operating system terminates the process via segmentation fault signals such as SIGSEGV on Unix-like systems or EXCEPTION_ACCESS_VIOLATION on Windows platforms. This allows an unauthenticated attacker who can supply malicious schema files to disrupt service availability for legitimate users relying on the FlatBuffers serialization library. Although the immediate effect is a crash, out-of-bounds reads generally carry risks of information disclosure if the accessed memory contains sensitive data such as cryptographic keys or internal application state, although in this specific one-byte over-read scenario, the likelihood of extracting meaningful intelligence is low compared to larger buffer over-reads.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability maps to techniques involving resource exhaustion and potential initial access vectors if the parser is exposed via network services without proper input validation. The lack of robust error handling for malformed inputs represents a common weakness in C-based parsers that prioritize performance over defensive programming practices. To mitigate this risk, developers should implement strict boundary checks within the lexer logic to ensure that string scanning operations do not proceed beyond the allocated buffer size. Additionally, integrating fuzzing tools into the continuous integration pipeline can help identify similar edge cases before deployment. Upgrading to patched versions of flatcc where these bounds are enforced is the primary remediation strategy for organizations utilizing this library in production environments.