OSV-2026-777 Heap-buffer-overflow in md_is_link_title

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=514122612 Crash type: Heap-buffer-overflow READ 1 Crash state: mdislinktitle mdanalyzeinlines mdprocessnormalblockcontents...

OSV-2024-1464 Use-of-uninitialized-value in Splash::compositeBackground

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513891492 Crash type: Use-of-uninitialized-value Crash state: Splash::compositeBackground SplashOutputDev::setSoftMask Gfx::doSoftMask...

OSV-2026-765 Heap-use-after-free in gf_node_get_id

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513783541 Crash type: Heap-use-after-free READ 8 Crash state: gfnodegetid lsrreadcommandlist lsrdecodelaserunit...

OSV-2026-760 Heap-buffer-overflow in md_decode_utf8__

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513677122 Crash type: Heap-buffer-overflow READ 1 Crash state: mddecodeutf8 mdskipunicodewhitespace mdlinklabelhash...

OSV-2026-733 Use-of-uninitialized-value in JBIG2Stream::readSymbolDictSeg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512468082 Crash type: Use-of-uninitialized-value Crash state: JBIG2Stream::readSymbolDictSeg JBIG2Stream::readSegments JBIG2Stream::rewind...

OSV-2026-727 Global-buffer-overflow in md_start_new_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512429152 Crash type: Global-buffer-overflow READ 4 Crash state: mdstartnewblock mdparse mdhtml...

OSV-2026-717 Stack-use-after-scope in enter_block_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511831392 Crash type: Stack-use-after-scope READ 4 Crash state: enterblockcallback mdprocessallblocks mdparse...

OSV-2026-712 Heap-buffer-overflow in Mat_VarGetCellsLinear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511531637 Crash type: Heap-buffer-overflow READ 8 Crash state: MatVarGetCellsLinear matiostructcellfuzzer.cpp...

OSV-2026-703 Heap-use-after-free in js_atomics_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=510792185 Crash type: Heap-use-after-free WRITE 4 Crash state: jsatomicsop jscallcfunction JSCallInternal...

OSV-2026-696 Use-of-uninitialized-value in JXRHandler::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=510577322 Crash type: Use-of-uninitialized-value Crash state: JXRHandler::read kimgiofuzzer.cc interceptormalloc...

OSV-2026-649 Container-overflow in OGRGeometryFactory::organizePolygons

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506932597 Crash type: Container-overflow WRITE 1 Crash state: OGRGeometryFactory::organizePolygons OGRCreateFromShapeBin OpenFileGDB::FileGDBOGRGeometryConverterImpl::CreateCurveGeometry...

OSV-2026-632 Use-of-uninitialized-value in PKFormatConverter_InitializeConvert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506459298 Crash type: Use-of-uninitialized-value Crash state: PKFormatConverterInitializeConvert PKFormatConverterInitialize JXRHandler::read...

OSV-2026-629 Security exception in org.apache.thrift.protocol.TProtocolUtil.skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506318134 Crash type: Security exception Crash state: org.apache.thrift.protocol.TProtocolUtil.skip org.apache.thrift.protocol.TCompactProtocol.readByte org.apache.thrift.protocol.TCompactProtocol.readFieldBegin...

OSV-2026-621 Use-of-uninitialized-value in vcardtime_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903588 Crash type: Use-of-uninitialized-value Crash state: vcardtimefromstring vcardvaluenewfromstring parsevcard...

OSV-2026-620 Heap-buffer-overflow in ixheaace_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505674302 Crash type: Heap-buffer-overflow WRITE Crash state: ixheaaceprocess xaacencfuzzer.cpp...

OSV-2026-616 Use-of-uninitialized-value in JXRHandlerPrivate::colorSpace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505263965 Crash type: Use-of-uninitialized-value Crash state: JXRHandlerPrivate::colorSpace JXRHandlerPrivate::imageFormat JXRHandler::read...

OSV-2026-605 Heap-buffer-overflow in DwaCompressor_uncompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504280155 Crash type: Heap-buffer-overflow WRITE Crash state: DwaCompressoruncompress internalexrundodwaa exruncompresschunk...

OSV-2026-603 UNKNOWN READ in <wasmtime::runtime::func::Func>::call_unchecked_raw::<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504268343 Crash type: UNKNOWN READ Crash state: ::calluncheckedraw::::callimpldocall:: wasmtimeinternalfiber::stackswitch::x8664::wasmtimefiberstart...

OSV-2026-600 Heap-buffer-overflow in skcms_private::baseline::clut

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504261818 Crash type: Heap-buffer-overflow READ 8 Crash state: skcmsprivate::baseline::clut skcmsprivate::baseline::execstages skcmsprivate::baseline::runprogram...

OSV-2026-582 Use-of-uninitialized-value in H5S_select_hyperslab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=502905691 Crash type: Use-of-uninitialized-value Crash state: H5Sselecthyperslab H5Dchunkioinit H5Dread...