Medium severity · published Sep 14, 2026
CVE-2026-90785
Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f705032346ee39efd7d3848c50b73d455d28d06d. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flatcc · Dvidelabs
0.6.0; 0.6.1; 0.6.2; 0.6.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90785
github.com
https://github.com/dvidelabs/flatcc/
github.com
https://github.com/dvidelabs/flatcc/commit/f705032346ee39efd7d3848c50b73d455d28d06d
github.com
https://github.com/dvidelabs/flatcc/issues/388
vuldb.com
https://vuldb.com/cve/CVE-2026-90785
vuldb.com
https://vuldb.com/submit/919200
vuldb.com
https://vuldb.com/vuln/403291
More from flatcc
5.3
CVE-2026-90786
Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion
5.3
CVE-2026-90784
Dvidelabs flatcc semantics.c fb_clear_parser memory leak
3.7
CVE-2026-116734
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
3.7
CVE-2026-116733
flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number