CVE-2026-50643— Out‑of‑Bounds Read in 8cc
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50643
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out‑of‑Bounds Read in 8cc
Source: CVE Program / CVE List V5
Vulnerability Description
8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename and line number metadata and later uses it without validation when accessing source line arrays. By supplying invalid or oversized line numbers, an attacker can trigger out-of-bounds memory access and a crash. Maintainer of this project was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Version corresponding to the commit b480958 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Rui Ueyama 8cc 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rui Ueyama 8cc是Rui Ueyama个人开发者的一款C语言编译器。 Rui Ueyama 8cc b480958版本存在缓冲区错误漏洞，该漏洞源于对#line指令和GNU行标记处理不当，导致越界读取，攻击者可通过提供无效或超大的行号触发越界内存访问和崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-50643
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50643
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-50643 (1)
- 🔗 Page not found | CERT Polskathird-party-advisory
Other References for CVE-2026-50643 (1)
IV. Related Vulnerabilities
Same weakness: CWE-125
- CVE-2026-19955
TrailDB TOC Validation tdb.c tdb_open out-of-bounds - CVE-2026-49282
Capstone M68K and RISCV `cs_insn_name()` invalid IDs can tri - CVE-2026-18020
IBM i is Affected By Multiple Vulnerabilities in NetServer - CVE-2026-17649
IBM i is Affected By Multiple Vulnerabilities in NetServer - CVE-2026-17226
IBM i is Affected By Multiple Vulnerabilities in NetServer
V. Comments for CVE-2026-50643
No comments yet