OSV-2026-1095 Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=540111888 Crash type: Heap-buffer-overflow READ 8 Crash state: grk::t1::CodeblockDecompressImpl::parsePacketData grk::PacketParser::readData grk::PacketParser::parsePacketData...

grok:grk_decompress_fuzzer: Heap-double-free in grk::DecompressCodeblock::release

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4940245421654016 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

OSV-2021-446 Global-buffer-overflow in AK::StringView::operator==

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31351 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== Markdown::CodeBlock::parse bool Markdown::helper...

PT-2021-28118

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a global buffer overflow read. The crash occurs in the AK::StringView::operator== function, which is called by...

serenity:FuzzMarkdown: Global-buffer-overflow in AK::StringView::operator==

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5630927108702208 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzMarkdown Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

OSV-2020-2216 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28103 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

Detailed Report: https://oss-fuzz.com/testcase?key=6043228666855424 Project: grok Fuzzing Engine: afl Fuzz Target: grkdecompressfuzzer Job Type: aflasangrok Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x61d00177e480 Crash State: ojph::local::ojphdecodecodeblock...

PT-2020-22159

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the crash type being a Heap-buffer-overflow WRITE 4. The...

OSV-2020-2167 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27533 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free Exploit

WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free Exploit / While fuzzing JavaScriptCore, I encountered the following simplified and commented JavaScript program which crashes jsc from current HEAD and release: / function v9 // Some watchpoint on the LexicalEnvironment is...

WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free

/ While fuzzing JavaScriptCore, I encountered the following simplified and commented JavaScript program which crashes jsc from current HEAD and release: / function v9 // Some watchpoint on the LexicalEnvironment is triggered here // during the 2nd invocation which jettisons the CodeBlock for v9. ...

WS-2019-0092

A Denial of Service vulnerability exists in pulldown-cmark before version 0.5.0 in the parsing of the codeblock section...

WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling

scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase. PoC: -- function f function eval'1'; f; ; throw 1; f;...

Apple WebKit - JSC::SymbolTableEntry::isWatchable Heap Buffer Overflow Exploit

Exploit for multiple platform in category dos / poc function x = 0 var a; function arguments function b var g = 1; a5; f; g; ; , unsigned int, unsigned int webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore+...

WebKit: heap-buffer-overflow in JSC::SymbolTableEntry::isWatchable (CVE-2017-2469)

I confirmed the PoC crashes the release version of Safari 10.0.312602.4.8. It might need to refresh the page several times. PoC: function x = 0 var a; function arguments function b var g = 1; a5; f; g; ; Asan Log: ==55079==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c0000c8e88 at...