CVE-2026-90786: Dvidelabs flatcc RCE Vulnerability

CVE-2026-90786 Overview

CVE-2026-90786 is a reachable assertion vulnerability [CWE-617] in Dvidelabs flatcc versions up to 0.6.3. The flaw resides in the align_order_members function within src/compiler/semantics.c, part of the Duplicate Symbol Handler component. When flatcc processes a schema containing duplicate symbols, the ordering logic proceeds without checking a prior failure state, triggering an unhandled assertion that terminates the process.

The issue is remotely reachable when flatcc parses attacker-supplied FlatBuffers schema input. A public exploit exists, and the maintainers published a fix in commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205.

Critical Impact
A crafted schema with duplicate symbols crashes any service or build pipeline invoking flatcc, producing a denial-of-service condition.

Affected Products

Dvidelabs flatcc versions up to and including 0.6.3
Applications and build pipelines that link or invoke the flatcc schema compiler
Downstream tooling that processes untrusted FlatBuffers schema files with vulnerable flatcc releases

Discovery Timeline

2026-09-14 - CVE-2026-90786 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in the NVD database

Technical Details for CVE-2026-90786

Vulnerability Analysis

The defect sits in the semantic analysis stage of the flatcc schema compiler. During processing, align_order_members orders struct members based on metadata flags. The function assumes that earlier passes rejected schemas with duplicate symbol definitions. When a duplicate is present but the failure state is not consulted before ordering, the compiler enters code paths whose invariants are violated, and an assertion fires.

The assertion terminates the process rather than returning an error to the caller. Any workflow that feeds untrusted or externally provided schemas into flatcc inherits the crash. This includes continuous integration systems, code-generation microservices, and IDE plug-ins that regenerate FlatBuffers bindings on demand.

Root Cause

The root cause is a missing early-abort check in align_order_members. The ordering logic executes even after prior duplicate-symbol detection recorded a failure in the parser state P->failed. Because ordering assumes uniqueness of symbols, subsequent operations violate invariants that are enforced by assert() calls, producing a reachable assertion under attacker-controlled input.

Attack Vector

An attacker supplies a FlatBuffers schema containing duplicate symbol definitions to any service or tool that invokes flatcc. No authentication or user interaction is required when the compiler is reachable through a network-facing pipeline. Successful exploitation aborts the compiler process, denying service to the schema-processing component.

// Patch from src/compiler/semantics.c (align_order_members)
// Source: https://github.com/jimjag/flatcc/commit/8b19ba4e992ebcad7f5970704d1afc5507fa5205
            id_failed = 1;
        }
    }
+   // Ordering assumes there are no duplicates so conservatively abort on error.
+   if (P->failed) return P->failed;
    /* Order in which data is ordered in binary buffer. */
    if (ct->metadata_flags & fb_f_original_order) {
        ct->ordered_members = original_order_members(P, (fb_member_t *)ct->members);

The patch adds an early return that propagates the existing failure state before ordering runs, preventing the invariant violation.

Detection Methods for CVE-2026-90786

Indicators of Compromise

Abnormal termination of flatcc or flatcc-linked processes with SIGABRT and an assertion failure message referencing semantics.c
Build pipeline logs showing repeated schema compilation crashes when processing externally supplied .fbs files
Core dumps generated from flatcc invocations against untrusted schema input

Detection Strategies

Inventory build hosts and services for flatcc binaries and libraries at version 0.6.3 or earlier using software composition analysis (SCA) tooling
Inspect CI job history for repeated non-zero exits from schema-generation steps that coincide with untrusted schema uploads
Monitor process telemetry for flatcc termination via abort() on hosts running code-generation workloads

Monitoring Recommendations

Enable core-dump collection on build agents and forward crash telemetry to a centralized logging or SIEM platform
Alert on unexpected exit codes from schema compilation stages in CI/CD pipelines
Track ingestion of user-supplied schema files and correlate against flatcc crash events

How to Mitigate CVE-2026-90786

Immediate Actions Required

Upgrade flatcc past commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205 on all build servers, developer workstations, and container images
Rebuild and redeploy any downstream binaries or services that statically link flatcc
Restrict schema-processing services so they only accept .fbs input from trusted sources until patching completes

Patch Information

The fix is published in the upstream repository as commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205. The change adds an early if (P->failed) return P->failed; guard in align_order_members to abort ordering when duplicate-symbol detection has already recorded a failure. Consult the GitHub Commit 8b19ba4 and the GitHub Issue #387 Report for the full change and discussion.

Workarounds

Reject or pre-validate .fbs schema files for duplicate type, field, or enum symbol declarations before invoking flatcc
Run flatcc inside a sandbox or isolated container so crashes do not affect the host or adjacent services
Add supervisor logic that restarts schema-generation workers on abort, limiting sustained denial-of-service impact

bash

# Rebuild flatcc from a patched source tree
git clone https://github.com/dvidelabs/flatcc.git
cd flatcc
git fetch origin
git checkout 8b19ba4e992ebcad7f5970704d1afc5507fa5205
mkdir -p build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j"$(nproc)"
./bin/flatcc --version