Out-of-Bounds Read Vulnerability in Flatcc by DviDelabs
CVE-2026-116733

6.3MEDIUM

Key Information:

Vendor

Dvidelabs

Status
Flatcc
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116733?

An out-of-bounds read vulnerability exists in Flatcc prior to version 0.6.4 within the function __flatcc_json_parser_number. This flaw allows attackers to exploit the JSON parsing capabilities by supplying crafted input—specifically, numbers that end with a decimal point. If an application utilizes this flawed function and receives untrusted JSON data, it may attempt to read beyond the allocated buffer, which can lead to application crashes as the parser accesses unmapped memory pages.

Affected Version(s)

flatcc 0 <= 0.6.4

References

https://github.com/dvidelabs/flatcc/commit/356792dc155a9e...
patch
https://github.com/dvidelabs/flatcc
product
https://github.com/dvidelabs/flatcc/blob/v0.6.4/src/runti...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
mikkelfj
.