Integer Overflow Vulnerability in FlatBuffers Verifier of FlatCC
CVE-2026-116734

6.3MEDIUM

Key Information:

Vendor

Dvidelabs

Status
Flatcc
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116734?

The FlatBuffers verifier in FlatCC versions up to 0.6.4 is susceptible to an integer overflow vulnerability located in the check_header function. This flaw results from ineffective overflow guard measures, classifying it as dead code. Attackers targeting 32-bit builds can exploit this vulnerability by submitting a specially crafted buffer offset that circumvents the bounds check, potentially leading to an out-of-bounds read that crashes the process. This critical issue necessitates immediate attention to safeguard systems relying on FlatCC.

Affected Version(s)

flatcc 0 <= 0.6.4

References

https://github.com/dvidelabs/flatcc/commit/0df9c097a19bad...
patch
https://github.com/dvidelabs/flatcc
product
https://github.com/dvidelabs/flatcc/blob/v0.6.4/src/runti...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
mikkelfj
.