{"id":"CVE-2026-116734","kind":"vulnerability","aliases":["CVE-2026-116734"],"related":[],"title":"flatcc: integer overflow in FlatBuffers header check crashes 32-bit builds","description":"flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.","summary":"flatcc through 0.6.4 has a dead-code overflow guard in its FlatBuffers verifier's check_header function. On 32-bit builds, a crafted buffer offset wraps the bounds check and causes an out-of-bounds read before the buffer, which crashes the process.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","c","flatbuffers","flatcc","package"],"not_affected_if":["64-bit-only-builds","trusted-input-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:57+00:00","updated_at":"2026-10-26T22:27:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"flatcc: integer overflow in FlatBuffers header check crashes 32-bit builds","impact":"low","summary":"flatcc through 0.6.4 has a dead-code overflow guard in its FlatBuffers verifier's check_header function. On 32-bit builds, a crafted buffer offset wraps the bounds check and causes an out-of-bounds read before the buffer, which crashes the process.","category":"package","nicknames":[],"who_cares":["flatcc","flatbuffers","32-bit","c"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Out-of-bounds read crashes the process; code execution not described.","analyst_note":"Confirm the fixed flatcc version and whether any downstream products bundle flatcc, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116734.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["64-bit-only-builds","trusted-input-only"],"who_is_affected":"Teams that compile or run flatcc 0.6.4 or earlier on 32-bit targets and pass untrusted FlatBuffers input to its verifier. The sources do not say which products bundle flatcc. 64-bit builds are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000581,"input_tokens":3333,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116734':14A,17A '-2026':13A,16A '0.6.4':26B,71C '32':9A,18B,43B,94C 'attack':97C 'bit':10A,19B,44B,95C 'bound':52B,60B,107C,114C 'buffer':48B,64B,102C,118C 'build':11A,45B,96C 'c':20B 'caus':55B,109C 'check':7A,39B,53B,79C,108C 'code':31B,92C 'contain':72C 'craft':47B,101C 'crash':8A,66B,120C 'cve':12A,15A 'dead':30B,91C 'dead-cod':29B 'flatbuff':5A,21B,36B,84C 'flatcc':1A,22B,24B,69C 'function':41B,81C 'guard':33B,89C 'header':6A,40B,80C 'integ':2A,74C 'offset':49B,103C 'out-of-bound':57B,111C 'overflow':3A,32B,75C,88C 'packag':23B 'process':68B,122C 'read':61B,115C 'suppli':99C 'verifi':37B,85C 'vulner':76C 'wrap':50B,105C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile or run flatcc 0.6.4 or earlier on 32-bit targets and pass untrusted FlatBuffers input to its verifier. The sources do not say which products bundle flatcc. 64-bit builds are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116734","severity":null,"published_at":"2026-10-26T22:16:57+00:00","modified_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}