CVE-2026-88344: flatcc Schema Lexer DOS Vulnerability

CVE-2026-88344 Overview

CVE-2026-88344 is an out-of-bounds read vulnerability in the schema lexer of flatcc at commit 4c3b999e. The flaw exists in the lex() function within external/lex/luthor.c. When a FlatBuffers schema buffer ends exactly on a digit, the integer digit-scan loop advances past the end of the input buffer. This dereference of an out-of-bounds pointer triggers a one-byte heap buffer over-read. A specially crafted schema causes an application crash, resulting in denial of service. The weakness is categorized as [CWE-22] in the NVD record and affects applications that parse untrusted FlatBuffers schemas using flatcc.

Critical Impact
A crafted FlatBuffers schema triggers a heap buffer over-read in the flatcc lexer, crashing the parsing process and denying service to any application that ingests untrusted schemas.

Affected Products

flatcc at commit 4c3b999e
FlatBuffers schema compilation tools built on the affected flatcc lexer
Downstream applications embedding the external/lex/luthor.c lexer

Discovery Timeline

2026-09-22 - CVE-2026-88344 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-88344

Vulnerability Analysis

The vulnerability resides in the tokenizer path that handles C-style integer literals. When the lexer encounters an ASCII digit (1 through 9), it enters a scan loop that increments the input pointer p while the current byte remains a digit. The loop terminates only on a non-digit character, ignoring the end-of-buffer sentinel q. When the schema buffer ends exactly on a digit and no trailing terminator or whitespace follows, p advances one byte beyond the allocated buffer. The subsequent dereference reads unmapped or adjacent heap memory. A follow-up check against the character . (used to detect the fractional part of a floating-point literal) reads the same out-of-bounds byte. Depending on heap layout and allocator behavior, this produces a segmentation fault or an ASan-detected heap-buffer-overflow read.

Root Cause

The root cause is a missing bounds check between the moving pointer p and the end-of-input sentinel q inside the digit-scan and lookahead logic. The lexer trusts the input to contain a terminating non-digit byte and never validates that the scan remains within the caller-supplied length.

Attack Vector

Exploitation requires the target to parse an attacker-supplied FlatBuffers schema whose final byte is an ASCII digit. Any pipeline that compiles or validates untrusted .fbs schemas from network sources is reachable without authentication.

             /* Leading integer digit in C integers. */
         case '1': case '2': case '3': case '4': case '5':
         case '6': case '7': case '8': case '9':
-            while (++p && lex_isdigit(*p)) {
+            while (++p != q && lex_isdigit(*p)) {
             }
             d = p;
-            if (*p == '.') {
+            if (p != q && *p == '.') {
 /* Silence unused label warnings when features are disabled. */
 #ifdef LEX_C_OCTAL_NUMERIC
 lex_c_octal_to_fraction_part:

Source: GitHub Flatcc Commit Details. The patch replaces the unbounded ++p increment with a bounds-checked ++p != q comparison and gates the . lookahead behind the same check.

Detection Methods for CVE-2026-88344

Indicators of Compromise

Unexpected crashes or SIGSEGV termination of processes invoking the flatcc schema compiler.
AddressSanitizer reports of heap-buffer-overflow READ of size 1 inside lex() in external/lex/luthor.c.
Repeated schema-parsing failures correlated with externally sourced .fbs files ending on a numeric character.

Detection Strategies

Fuzz the flatcc schema parser with corpora that omit trailing whitespace and terminate on digits to reproduce the over-read.
Build affected binaries with AddressSanitizer or Valgrind in CI to catch the one-byte over-read at compile-time validation.
Inventory source trees and container images for vendored copies of external/lex/luthor.c matching the pre-patch signature.

Monitoring Recommendations

Alert on abnormal termination of build agents, schema-validation microservices, and IDL preprocessors that consume external FlatBuffers input.
Log the source and hash of every schema ingested from untrusted origins for post-incident analysis.
Monitor CI/CD pipelines for crash loops tied to schema-compilation stages.

How to Mitigate CVE-2026-88344

Immediate Actions Required

Update flatcc to a revision that includes commit c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e or later.
Rebuild and redistribute any binary artifacts that statically link the affected luthor.c lexer.
Restrict schema ingestion endpoints to authenticated, trusted producers until the patch is deployed.

Patch Information

The upstream fix is tracked in GitHub Flatcc Issue Discussion and applied in GitHub Flatcc Commit Details. The change introduces a p != q guard inside the integer digit-scan loop and the subsequent . lookahead, preventing the pointer from advancing past the caller-supplied buffer end.

Workarounds

Pre-validate incoming schema buffers and append a benign terminator byte such as a newline before invoking the lexer.
Reject schemas whose final byte is an ASCII digit at the ingestion boundary.
Sandbox the schema compiler in a separate process with restricted privileges so that a crash does not affect the parent service.

bash

# Apply the upstream patch and rebuild flatcc
git clone https://github.com/dvidelabs/flatcc.git
cd flatcc
git cherry-pick c1dcc8ecd1a74b1e9e724ec7dc98828a5c95528e
mkdir -p build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
make -j$(nproc)