---
id: "CVE-2026-116733"
kind: "vulnerability"
aliases: ["CVE-2026-116733"]
title: "flatcc: JSON number parser reads past input buffer, can crash"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "flatbuffers", "flatcc", "package", "untrusted-json-input"]
not_affected_if: ["no-json-parsing", "trusted-input-only"]
published_at: "2026-10-26T22:16:57+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116733", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# flatcc: JSON number parser reads past input buffer, can crash

flatcc through 0.6.4 has an out-of-bounds read in its JSON number parser when a number ends right after a decimal point. Feeding untrusted JSON to a generated parser can crash the application when the buffer ends at an unmapped page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the flatcc version in the project's lockfile or build files, for example `flatcc --version` on the build host, and compare against `0.6.4`
- Search the codebase for generated JSON parsers from flatcc that accept untrusted input: `grep -r "flatcc_json_parser" .`

## Fix

- Move to a flatcc release newer than `0.6.4` once the sources name one (unknown from the sources)
- Until patched, reject or pre-validate untrusted JSON that ends with a decimal point before it reaches the generated parser

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116733

## From the sources

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_