Live › vulnerability › CVE-2026-116733
Go to dashboardflatcc through 0.6.4 has an out-of-bounds read in its JSON number parser when a number ends right after a decimal point. Feeding untrusted JSON to a generated parser can crash the application when the buffer ends at an unmapped page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that use flatcc-generated JSON parsers on untrusted input are exposed, since an attacker controls the buffer end. Systems that only parse trusted or internally generated JSON, or that do not use flatcc's JSON parsing, can skip it. The sources do not say which downstream products embed flatcc.
No product ranges from the sources yet.
flatcc --version on the build host, and compare against 0.6.4grep -r "flatcc_json_parser" .0.6.4 once the sources name one (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.
This page as .md · .json · in your agent: get_signal("CVE-2026-116733")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.