CVE-2016-6354

Critical

Published: 21/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code.

Risk Assessment

The organization may be exposed to attacks leading to denial of service or unauthorized code execution, which could have serious security implications.

Recommendation

It is recommended to update Flex to version 2.6.1 or later to mitigate this vulnerability.

Original NVD description (English source)

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.