Medium severity · published Sep 14, 2026
CVE-2026-90784
Dvidelabs flatcc semantics.c fb_clear_parser memory leak
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8dbc3419738da066151991fd2bf1d0c85591dea2. It is suggested to install a patch to address this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flatcc · Dvidelabs
0.6.0; 0.6.1; 0.6.2; 0.6.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90784
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90784
github.com
https://github.com/dvidelabs/flatcc/
github.com
https://github.com/dvidelabs/flatcc/commit/8dbc3419738da066151991fd2bf1d0c85591dea2
github.com
https://github.com/dvidelabs/flatcc/issues/389
vuldb.com
https://vuldb.com/cve/CVE-2026-90784
vuldb.com
https://vuldb.com/submit/919199
vuldb.com
https://vuldb.com/vuln/403290
More from flatcc
5.3
CVE-2026-90786
Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion
5.3
CVE-2026-90785
Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion
3.7
CVE-2026-116734
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
3.7
CVE-2026-116733
flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number