CVE-2006-0459: flex.skl in Will Estes and John Millaway Fast… (CVSS 7.5)

NVD Score used 7.5

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: CVE-2006-0459
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: CVE-2006-0459
Updated: 2026-11-02

EUVDEUVD-2006-0466 No score

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: EUVD-2006-0466
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c6v8-67cp-6v4p No score

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33...

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: GHSA-c6v8-67cp-6v4p
Weakness: CWE-119
Updated: 2026-11-02

OSVBELL-CVE-2006-0459 7.5

CVE-2006-0459 does not affect BellSoft software

Record: BELL-CVE-2006-0459
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

OSV No score

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: CVE-2006-0459
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-0459 No score

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Record: DEBIAN-CVE-2006-0459
Updated: 2026-11-02

Package	Affected	Fixed
`flex` Debian:12	before 2.5.33-1	2.5.33-1
`flex` Debian:13	before 2.5.33-1	2.5.33-1
`flex` Debian:14	before 2.5.33-1	2.5.33-1
`flex` Debian:3.1	before 2.5.31-31sarge1, plus listed versions 2.5.31-31	2.5.31-31sarge1

When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

CVE-2006-0459

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References