CVE-2026-50643 describes an out-of-bounds read vulnerability (CWE-125) in the 8cc compiler from the rui314 project. The issue stems from the compiler's acceptance and use of attacker-controlled #line directive metadata, including filenames and line numbers, without proper validation. This can lead to out-of-bounds access of source line arrays when invalid or excessively large line numbers are processed, potentially causing a crash. The vulnerability was confirmed in the version corresponding to commit b480958. The maintainer has not provided details on the vulnerable version range or any fixes. No known exploits are reported in the wild.

An attacker who can supply crafted source code with malicious #line directives can cause the 8cc compiler to perform out-of-bounds reads on memory, which may lead to a crash of the compiler process. This could disrupt compilation workflows or be leveraged in denial-of-service scenarios. There is no indication of code execution or data leakage beyond the out-of-bounds read and crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the maintainer has not responded with details or fixes, users should avoid processing untrusted source files containing #line directives or GNU linemarkers until an official fix or guidance is available. Monitoring the project repository and security advisories for updates is recommended.