CVE-2026-116733 dvidelabs CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use flatcc should assess exposure and prioritize patching to prevent potential crashes and information disclosure. This includes reviewing and updating affected systems and dependencies, monitoring for potential exploitation attempts, and verifying the vulnerability and patching flatcc installations. Defenders should also review the supplied official advisory or CVE record to validate affected

Why it matters

CVE-2026-116733 is an out-of-bounds read vulnerability in flatcc through 0.6.4 that allows attackers to read past the input buffer via numbers ending in a decimal point, potentially causing crashes and information disclosure. Defenders should prioritize verifying and patching flatcc installations.

• Potential crashes and information disclosure due to out-of-bounds read vulnerability.
• Need to verify and patch flatcc installations to prevent exploitation.
• Possible impact on system stability and security.

Technical summary

The out-of-bounds read vulnerability in flatcc through 0.6.4 allows attackers to read past the input buffer via numbers ending in a decimal point. This can cause applications to crash when the buffer ends at an unmapped page. The vulnerability is caused by a parsing issue in the __flatcc_json_parser_number function. Defenders should prioritize verifying and patching flatcc installations to prevent potential crashes and information disclosure. The CVE record and source item provide details on the vulnerability, and additional review of affected systems and dependencies is recommended.

Defensive priority

Defenders should prioritize verifying and patching flatcc installations to prevent potential crashes and information disclosure.

Recommended defensive actions

• Verify and patch flatcc installations to prevent potential crashes and information disclosure.
• Review and update affected systems and dependencies.
• Monitor for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the out-of-bounds read vulnerability in flatcc through 0.6.4. The vulnerability allows attackers to read past the input buffer via numbers ending in a decimal point. Evidence is limited to the CVE record and source item, and defenders should verify the vulnerability and patch flatcc installations. Additional review of affected systems and dependencies is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.