Out-of-Bounds Read Vulnerability in 8cc Compiler by Rui314

CVE-2026-50643

What is CVE-2026-50643?

The 8cc compiler is susceptible to an Out-of-Bounds Read vulnerability due to inadequate handling of #line directives and GNU linemarkers. This security flaw occurs when the compiler processes attacker-controlled filename and line number metadata without proper validation. By leveraging invalid or excessively large line numbers, an attacker can exploit this vulnerability, leading to out-of-bounds memory access and a potential crash of the system. Although the maintainer was notified of the issue, there has been no response regarding the specifics of the vulnerability or confirmation of potentially vulnerable versions beyond the tested version corresponding to commit b480958.

References