Google Flatbuffers vulnerabilities

2 CVEs affecting Google Flatbuffers, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-35864, published 2020-12-31.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-35864, published 2020-12-31. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
• CVE-2019-25004, published 2020-12-31. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.