CVE-2026-90785: Dvidelabs flatcc RCE Vulnerability

CVE-2026-90785 Overview

A reachable assertion vulnerability exists in Dvidelabs flatcc through version 0.6.3. The flaw resides in the analyze_struct function of src/compiler/semantics.c within the Struct Analysis component. When flatcc processes a FlatBuffers schema containing a circular struct reference, the compiler reaches an assertion that terminates the process, producing a denial-of-service condition. The issue is remotely triggerable when flatcc processes attacker-supplied schema input, and a public exploit exists. The upstream project has published a patch identified by commit f705032346ee39efd7d3848c50b73d455d28d06d.

Critical Impact
A malformed FlatBuffers schema triggers an assertion failure in analyze_struct, aborting the flatcc compiler and denying schema compilation services.

Affected Products

Dvidelabs flatcc versions up to and including 0.6.3
Applications and build pipelines that invoke flatcc on untrusted schemas
Downstream projects bundling vulnerable flatcc source under src/compiler/semantics.c

Discovery Timeline

2026-09-14 - CVE-2026-90785 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90785

Vulnerability Analysis

The defect is a reachable assertion classified under [CWE-617]. The analyze_struct function in src/compiler/semantics.c walks the schema's struct definitions to compute alignment and layout. When a circular struct reference has already been flagged as failed by an earlier pass, the function still proceeds to evaluate assertions such as assert(!(ct->symbol.flags & fb_circular_open)). That assertion fires, calling abort() and terminating the flatcc compiler process. The condition is deterministically reachable through crafted schema input rather than through memory corruption, so it does not enable code execution or data disclosure.

Root Cause

The compiler lacks an early-exit check when the semantic analyzer has already recorded a failure. Downstream analysis routines rely on assertions to enforce invariants that no longer hold once a circular reference is detected. The absence of the if (P->failed) return P->failed; guard at the top of analyze_struct allowed the assertion path to be reached during recursive processing of a self-referential struct.

Attack Vector

An attacker supplies a FlatBuffers schema containing a circular struct reference to any service, build pipeline, or tool that invokes flatcc. When the compiler processes the schema, analyze_struct triggers the assertion and terminates. The attack requires no authentication and no user interaction beyond the normal schema-processing workflow. Exposure is highest where flatcc is invoked automatically on user-submitted .fbs files, for example in CI systems or code-generation web services.

     uint16_t align;
     fb_token_t *t;

+    /* Avoid triggering assertions on already detected circular references. */
+    if (P->failed) return P->failed;
+
     assert(ct->symbol.kind == fb_is_struct);

     assert(!(ct->symbol.flags & fb_circular_open));

Source: GitHub Commit f705032 — the patch adds an early return when the parser has already flagged a failure, preventing the recursive descent that reaches the assertion.

Detection Methods for CVE-2026-90785

Indicators of Compromise

Unexpected termination of the flatcc process with an assertion failure message referencing semantics.c or analyze_struct.
Repeated non-zero exit codes and core dumps from FlatBuffers schema compilation jobs in CI logs.
Submission of .fbs schema files containing self-referential or mutually recursive struct definitions from untrusted sources.

Detection Strategies

Inspect the flatcc binary version and source tree for commits predating f705032346ee39efd7d3848c50b73d455d28d06d.
Add build-system monitoring to alert on flatcc exit codes indicative of SIGABRT (typically 134 on Linux).
Perform static review of ingested schemas to flag struct fields whose types reference their enclosing struct.

Monitoring Recommendations

Ship flatcc stderr and CI job exit codes to a centralized log store and alert on assertion strings.
Track flatcc process crashes over time; a spike in schema-processing failures may indicate targeted abuse.
Correlate schema uploads with subsequent compiler crashes to identify the offending client or source.

How to Mitigate CVE-2026-90785

Immediate Actions Required

Update flatcc to a build that includes commit f705032346ee39efd7d3848c50b73d455d28d06d.
Rebuild and redeploy any tooling, containers, or SDKs that statically link or vendor flatcc source.
Restrict schema submission to authenticated users while patching is in progress.

Patch Information

The upstream fix is available in the flatcc repository as commit f705032346ee39efd7d3848c50b73d455d28d06d. The patch adds a short-circuit check in analyze_struct so the function returns immediately when the parser state is already marked as failed. Additional context is available in GitHub Issue #388 and the VulDB entry for CVE-2026-90785.

Workarounds

Pre-validate schemas for circular struct references before invoking flatcc.
Sandbox flatcc invocations so an assertion failure does not disrupt the parent build service, and enforce automatic restarts.
Reject schema uploads that exceed a maximum struct-nesting depth to reduce the attack surface until patching completes.

bash

# Build flatcc from a patched revision and verify the fix is present
git clone https://github.com/dvidelabs/flatcc.git
cd flatcc
git checkout f705032346ee39efd7d3848c50b73d455d28d06d
mkdir -p build && cd build
cmake .. && cmake --build .
grep -n "P->failed" ../src/compiler/semantics.c