{"id":"CVE-2026-116733","kind":"vulnerability","aliases":["CVE-2026-116733"],"related":[],"title":"flatcc: JSON number parser reads past input buffer, can crash","description":"flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.","summary":"flatcc through 0.6.4 has an out-of-bounds read in its JSON number parser when a number ends right after a decimal point. Feeding untrusted JSON to a generated parser can crash the application when the buffer ends at an unmapped page.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","flatbuffers","flatcc","package","untrusted-json-input"],"not_affected_if":["no-json-parsing","trusted-input-only"],"how_to_check":"- Check the flatcc version in the project's lockfile or build files, for example `flatcc --version` on the build host, and compare against `0.6.4`\n- Search the codebase for generated JSON parsers from flatcc that accept untrusted input: `grep -r \"flatcc_json_parser\" .`","fix":"- Move to a flatcc release newer than `0.6.4` once the sources name one (unknown from the sources)\n- Until patched, reject or pre-validate untrusted JSON that ends with a decimal point before it reaches the generated parser","status":"open","published_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:28:01+00:00","updated_at":"2026-10-26T22:28:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a flatcc release newer than `0.6.4` once the sources name one (unknown from the sources)\n- Until patched, reject or pre-validate untrusted JSON that ends with a decimal point before it reaches the generated parser","reach":"unknown","title":"flatcc: JSON number parser reads past input buffer, can crash","impact":"low","summary":"flatcc through 0.6.4 has an out-of-bounds read in its JSON number parser when a number ends right after a decimal point. Feeding untrusted JSON to a generated parser can crash the application when the buffer ends at an unmapped page.","category":"package","nicknames":[],"who_cares":["c","flatcc","flatbuffers","untrusted-json-input"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Application crashes from out-of-bounds read on untrusted JSON input","analyst_note":"Find the fixed flatcc version and the upstream advisory or commit at https://nvd.nist.gov/vuln/detail/CVE-2026-116733; the sources give no fix version and no detail on whether the read can leak data beyond a crash.","how_to_check":"- Check the flatcc version in the project's lockfile or build files, for example `flatcc --version` on the build host, and compare against `0.6.4`\n- Search the codebase for generated JSON parsers from flatcc that accept untrusted input: `grep -r \"flatcc_json_parser\" .`","needs_analyst":true,"not_affected_if":["trusted-input-only","no-json-parsing"],"who_is_affected":"Applications that use flatcc-generated JSON parsers on untrusted input are exposed, since an attacker controls the buffer end. Systems that only parse trusted or internally generated JSON, or that do not use flatcc's JSON parsing, can skip it. The sources do not say which downstream products embed flatcc.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000676,"input_tokens":3345,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116733':13A,16A '-2026':12A,15A '0.6.4':27B,70C 'allow':85C 'applic':59B,115C 'attack':86C,100C 'bound':33B,76C 'buffer':8A,62B,92C,118C 'c':17B 'contain':71C 'crash':10A,57B,114C 'cve':11A,14A 'decim':47B,98C,109C 'end':43B,63B,95C,105C,119C 'feed':49B 'flatbuff':18B 'flatcc':1A,19B,25B,68C,80C 'generat':54B,112C 'immedi':106C 'input':7A,24B,91C 'json':2A,23B,37B,51B,81C,104C 'number':3A,38B,42B,83C,94C 'out-of-bound':30B,73C 'packag':20B 'page':67B,123C 'parser':4A,39B,55B,82C,113C 'past':6A,89C 'point':48B,99C,110C 'read':5A,34B,77C,88C 'right':44B 'suppli':102C 'unmap':66B,122C 'untrust':22B,50B,103C 'untrusted-json-input':21B 'via':93C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Applications that use flatcc-generated JSON parsers on untrusted input are exposed, since an attacker controls the buffer end. Systems that only parse trusted or internally generated JSON, or that do not use flatcc's JSON parsing, can skip it. The sources do not say which downstream products embed flatcc.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116733","severity":null,"published_at":"2026-10-26T22:16:57+00:00","modified_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}