Description

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8dbc3419738da066151991fd2bf1d0c85591dea2. It is suggested to install a patch to address this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T13:19:30.500Z",
  "pubdate": "2026-09-14T13:19:30.500Z",
  "executiveSummary": "A memory leak vulnerability has been identified in the flatcc compiler, specifically within the fb_clear_parser function located in src/Compiler/semantics.c.\nThe vulnerability affects versions up to 0.6.3 and allows for remote exploitation by a malicious actor.\nThe root cause is improper memory management during the parsing process, leading to allocated memory not being correctly freed, which results in a memory leak.\nSuccessful exploitation could result in significant resource exhaustion, potentially leading to denial-of-service (DoS) conditions on the host system where the flatcc compiler is executing.\nAs the exploit has been publicly disclosed, the risk of active exploitation is elevated.\nUsers and maintainers are strongly advised to apply the provided patch to remediate this issue, as no authentication or specific privilege escalation is necessarily required to trigger the vulnerability if the parser processes maliciously crafted input.",
  "technicalDetails": "The vulnerability is situated within the fb_clear_parser function, a critical component responsible for deallocating resources and cleaning up state during the FlatBuffers compilation process in the flatcc compiler.\nThe root cause of the memory leak is an error in the logic responsible for freeing allocated structures or buffers. When the compiler processes certain input data, specific execution paths within fb_clear_parser fail to release dynamically allocated memory. This leads to a gradual accumulation of orphaned memory segments each time the function is called with the triggering input.\nThe attack flow involves supplying the flatcc compiler with a specially crafted FlatBuffers schema or data file designed to exercise the vulnerable code path in src/Compiler/semantics.c. When the compiler attempts to parse this malicious input, the memory management routines fail to correctly decrement reference counts or invoke free() on allocated pointers, causing the leak.\nBecause flatcc can be utilized in various environments—including those that process untrusted user-supplied schemas—the vulnerability can be triggered remotely. An attacker does not require elevated privileges or authentication to reach the vulnerable code path; they simply need to submit input that is subsequently processed by the flawed fb_clear_parser function.\nThe impact of this memory leak is primarily cumulative. While a single invocation might leak a limited amount of memory, repeated submissions of malicious input can lead to substantial consumption of system memory. In environments where the compiler process persists (such as a backend service processing incoming schemas), this will eventually lead to memory exhaustion, triggering an out-of-memory (OOM) killer event or causing the application to crash, thereby achieving a denial-of-service.\nThis vulnerability persists across all versions of flatcc up to and including 0.6.3. The patch identified by the hash 8dbc3419738da066151991fd2bf1d0c85591dea2 corrects the resource cleanup logic within src/Compiler/semantics.c, ensuring that all allocated memory within the parser state is correctly accounted for and deallocated upon completion of the parsing function.\nThere are no complex heap-spraying or code-execution primitives identified; however, the persistent leakage creates a high-reliability DoS vector for any service or toolchain reliant on the flatcc compiler to process external data."
}