CVE-2026-88345: flatcc Schema Lexer DOS Vulnerability

CVE-2026-88345 Overview

CVE-2026-88345 is an out-of-bounds read vulnerability in the schema lexer of flatcc at commit 4c3b999e. The flaw resides in the lex() function within the C-string scanning logic. When a FlatBuffers schema of exact buffer length ends with an unterminated quotation mark, the parser dereferences the input pointer after it has already reached the end of the buffer. A specially crafted schema triggers a one-byte heap buffer over-read.

The issue is classified under [CWE-125] Out-of-Bounds Read. Successful exploitation causes an application crash and denial of service in any tool or service that compiles untrusted FlatBuffers schemas.

Critical Impact
A single crafted schema file can crash any process embedding the vulnerable flatcc schema compiler, disrupting build pipelines and services that accept user-supplied schemas.

Affected Products

flatcc FlatBuffers schema compiler at commit 4c3b999e
Applications and build pipelines embedding the vulnerable flatcc library
Downstream forks that had not merged the fix from commit 8581715

Discovery Timeline

2026-09-22 - CVE-2026-88345 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-88345

Vulnerability Analysis

The vulnerability lives in the string-scanning state machine inside external/lex/luthor.c. The lexer advances a pointer p through the input buffer bounded by q, emitting string parts as it goes. When scanning a quoted string, the original code checked for the closing quote character before verifying that p had not reached the buffer end q.

With an exact-length schema whose final byte is an opening quotation mark and no terminator, p reaches q while the loop still evaluates *p. That dereference reads one byte past the allocated buffer. The read may hit unmapped memory or trigger allocator canaries, terminating the process. Because the input pointer originates from a heap allocation holding the schema source, the over-read is a heap buffer over-read.

The impact is limited to availability. No control-flow hijack or information disclosure is described in the advisory, matching the CWE-125 classification and the vector components indicating no confidentiality or integrity loss.

Root Cause

The root cause is an ordering bug in the lexer's termination checks. The code tested for the closing " character before validating that the cursor had not passed the buffer end. Any schema whose length exactly matches an unterminated string context defeated the guard and produced the over-read.

Attack Vector

An attacker supplies a crafted FlatBuffers schema to any tool that invokes flatcc for compilation or validation. Because schemas are commonly accepted from source repositories, package registries, or upload endpoints, the attack surface can be reached over the network without authentication or user interaction.

            lex_emit_string_part(s, p);
            s = p;
        }
+       if (p == q || lex_iszterm(*p)) {
+           lex_emit_string_unterminated(p);
+           goto lex_mode_normal;
+       }
        if (*p == '\"') {
            ++p;
            lex_emit_string_end(s, p);
            goto lex_mode_normal;
        }
-       if (p == q || lex_iszterm(*p)) {
-           lex_emit_string_unterminated(p);
-           goto lex_mode_normal;
-       }
        if (*p == '\\') {
            ++p;
             /* Escape is only itself, whatever is escped follows separately. */

The patch moves the end-of-buffer and zero-terminator check ahead of the *p == '\"' comparison. This ensures the lexer emits an unterminated-string diagnostic and exits the state before dereferencing p past q. Source: GitHub Commit 8581715.

Detection Methods for CVE-2026-88345

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT termination of processes invoking flatcc or flatcc-linked binaries during schema parsing.
AddressSanitizer or heap allocator reports flagging a one-byte read past a heap allocation inside lex() in external/lex/luthor.c.
Repeated build-pipeline failures triggered by user-submitted .fbs schema files ending with an unterminated quotation mark.

Detection Strategies

Inventory all binaries and services that link against or embed flatcc and record the source commit or package version in use.
Run static composition analysis across source repositories for imports of the flatcc library at commit 4c3b999e or earlier.
Fuzz-test schema ingestion endpoints with malformed .fbs inputs, including exact-length buffers ending in ", to reproduce and identify vulnerable builds.

Monitoring Recommendations

Alert on crash telemetry from CI/CD workers and schema-processing services where the faulting function resolves inside the flatcc lexer.
Monitor upload endpoints and package registries for .fbs submissions that exhibit anomalous size or truncation patterns.
Correlate process crashes with the source of the schema input to identify potential abuse attempts against public-facing services.

How to Mitigate CVE-2026-88345

Immediate Actions Required

Rebuild any product that vendors flatcc against a source tree that includes commit 8581715e8ec4e5de8eea9fd6dad949e4dd7d0fa0.
Restrict schema-processing endpoints to authenticated users until the patched build is deployed.
Enable process supervision on services that invoke flatcc so that a crash triggered by a malicious schema does not cascade into extended downtime.

Patch Information

The upstream fix is available in GitHub Commit 8581715, which resolves the issue tracked in GitHub Issue #385. Pull the latest flatcc source, verify the presence of the reordered check in external/lex/luthor.c, and rebuild all dependent binaries.

Workarounds

Pre-validate incoming .fbs schemas to reject inputs that do not end with a newline or that contain unbalanced quotation marks.
Sandbox the flatcc invocation using seccomp, containers, or a restricted subprocess so that a crash cannot affect the parent service.
Impose strict input length limits on schema uploads to reduce the practical attack surface until the patch is applied.

bash

# Rebuild flatcc from a patched source tree
git clone https://github.com/dvidelabs/flatcc.git
cd flatcc
git fetch origin
git checkout main
grep -n "lex_emit_string_unterminated" external/lex/luthor.c
mkdir -p build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
cmake --build . --target flatcc