CVE-2026-116734: falha de média gravidade em dvidelabs flatcc
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
dvidelabs · flatccCVEs relacionadas — dvidelabs flatcc
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/dvidelabs/flatcchttps://github.com/dvidelabs/flatcc/blob/v0.6.4/src/runtime/verifier.c#L126-L137https://github.com/dvidelabs/flatcc/commit/0df9c097a19badc8bd22d93af8fd47bd291e5d9fhttps://hackmd.io/@haindpwn/flatcc-json-number-oob-readhttps://www.vulncheck.com/advisories/flatcc-through-0.6.4-out-of-bounds-read-via-verifier-check-header