CVE-2026-116734Low· 3.7▾ Sunlitflatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.
flatcc <= 0.6.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116733Low· 3.7flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
CVE-2026-90785Medium· 5.3A vulnerability was found in Dvidelabs flatcc up to 0.6.3
CVE-2026-90786Medium· 5.3A vulnerability was determined in Dvidelabs flatcc up to 0.6.3
CVE-2026-90784Medium· 5.3A vulnerability has been found in Dvidelabs flatcc up to 0.6.3
CVE-2025-14178Medium· 6.5In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or…
CVE-2024-22051Critical· 9.8CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability