CVE-2026-90785

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90785

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90785.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90785

Published

2026-09-14T13:15:10Z

Modified

2026-09-17T08:06:07Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion

Details

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f705032346ee39efd7d3848c50b73d455d28d06d. A patch should be applied to remediate this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90785.json"
}

References

Affected packages

Git / github.com/dvidelabs/flatcc

Affected ranges

Type

GIT

Repo

https://github.com/dvidelabs/flatcc

Events

Introduced

571dc4100670b0df51f727dc6ab747a8851f4695

Fixed

f705032346ee39efd7d3848c50b73d455d28d06d

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "last_affected": "0.6.0"
        },
        {
            "introduced": "0.6.1"
        },
        {
            "last_affected": "0.6.1"
        },
        {
            "introduced": "0.6.2"
        },
        {
            "last_affected": "0.6.2"
        },
        {
            "introduced": "0.6.3"
        },
        {
            "last_affected": "0.6.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.6.0

0.6.1

0.6.2

0.6.3

v0.*

v0.6.0

v0.6.1

v0.6.2

v0.6.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90785.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "94966330391936680029316481832497308601",
                "156661192400997419101058232909710599051",
                "301406825863283124158396304478064135206"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90785-17af77f9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dvidelabs/flatcc/commit/f705032346ee39efd7d3848c50b73d455d28d06d",
        "target": {
            "file": "src/compiler/semantics.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "224478370086280064936935806995865269839",
            "length": 3199
        },
        "id": "CVE-2026-90785-3d71f87a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dvidelabs/flatcc/commit/f705032346ee39efd7d3848c50b73d455d28d06d",
        "target": {
            "file": "src/compiler/semantics.c",
            "function": "analyze_struct"
        }
    }
]

vanir_signatures_modified

"2026-09-17T08:06:07Z"