CVE-2026-116733 Details
Description
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.
A memory safety vulnerability has been identified in FlatCC, a C library for handling FlatBuffers, through version 0.6.4. The issue resides in the JSON parser's number handling function, `__flatcc_json_parser_number`. This function improperly processes numbers that end with a decimal point, allowing for an out-of-bounds read. When untrusted JSON is parsed, the parser can read past the allocated buffer, potentially leading to a crash if the excess data crosses into an unmapped memory page. This vulnerability is triggered when the JSON parser encounters a number formatted to end with a decimal point, such as '5.', and the input buffer is precisely two bytes long, causing the parser to read one byte beyond the buffer's end.
The vulnerability has been patched in FlatCC version 0.6.4. Users should upgrade to this version or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flatcc | <= 0.6.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |