OSV-2026-119 Segv on unknown address in gpsd_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477658237 Crash type: Segv on unknown address Crash state: gpsdpoll FuzzDrivers.c...

OSV-2026-108 UNKNOWN in rapidjson::PrettyWriter<rapidjson::GenericStringBuffer<rapidjson::UTF8<char>, ra

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477111546 Crash type: UNKNOWN Crash state: rapidjson::PrettyWriter, ra bool rapidjson::GenericValue, rapidjson::MemoryPoolAllocat bool rapidjson::GenericValue, rapidjson::MemoryPoolAllocat...

OSV-2026-94 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476574781 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt...

OSV-2026-91 Use-after-poison in compress.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476224483 Crash type: Use-after-poison READ 1 Crash state: compress.cc LLVMFuzzerRunDriver selfdestruct...

OSV-2026-86 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431399 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange org.apache.poi.util.IOUtils.safelyClone org.apache.poi.ddf.EscherBlipRecord.setPictureData...

OSV-2025-1061 Security exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<ini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431391 Crash type: Security exception Crash state: org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup. org.apache.poi.hssf.record.aggregates.SharedValueManager.create...

OSV-2025-1059 Security exception in com.google.re2j.Machine.add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431390 Crash type: Security exception Crash state: com.google.re2j.Machine.add com.google.re2j.Machine$Thread. com.google.re2j.Machine.alloc...

OSV-2026-74 Heap-buffer-overflow in ___interceptor_strtol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476180586 Crash type: Heap-buffer-overflow READ 3 Crash state: interceptorstrtol Assimp::ObjFileParser::getFace Assimp::ObjFileParser::parseFile...

OSV-2026-65 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476179553 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop java.base/sun.nio.cs.UTF8$Encoder.encodeLoop...

OSV-2026-55 Use-of-uninitialized-value in vp9_quantize_fp_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475583924 Crash type: Use-of-uninitialized-value Crash state: vp9quantizefpavx2 blockyrd vp9pickintermode...

OSV-2026-53 Heap-use-after-free in graph::LigatureSubstFormat1::shrink

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475607265 Crash type: Heap-use-after-free READ 8 Crash state: graph::LigatureSubstFormat1::shrink graph::LigatureSubstFormat1::splitcontextt::shrink hbvectort graph::actuatesubtablesplitgraph::LigatureSu...

OSV-2026-49 Heap-buffer-overflow in check_sync_pes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475305126 Crash type: Heap-buffer-overflow READ Crash state: checksyncpes Demux demuxprocessstream...

OSV-2026-30 Use-of-uninitialized-value in vp9_quantize_fp_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474614578 Crash type: Use-of-uninitialized-value Crash state: vp9quantizefpavx2 blockyrd vp9pickintermode...

OSV-2026-4 UNKNOWN READ in rb_managed_id_table_lookup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472871119 Crash type: UNKNOWN READ Crash state: rbmanagedidtablelookup vmlookupcc rbvmsearchmethodslowpath...

OSV-2026-2 Heap-buffer-overflow in cmt_mpack_consume_uint_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472785094 Crash type: Heap-buffer-overflow WRITE 8 Crash state: cmtmpackconsumeuinttag cmtmpackunpackarray cmtmpackunpackmap...

OSV-2025-1049 Heap-buffer-overflow in unsigned char* std::__1::vector<unsigned char, std::__1::allocator<unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472222304 Crash type: Heap-buffer-overflow READ 1 Crash state: unsigned char std::1::vectorunsigned char, std::1::allocatorunsigned char pcpp::TLSECPointFormatExtension::getECPointFormatList...

OSV-2025-1018 Stack-buffer-overflow in lre_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471304472 Crash type: Stack-buffer-overflow READ 8 Crash state: lreexec fuzzregexp.c...

OSV-2025-1016 Use-of-uninitialized-value in js_create_function

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471075808 Crash type: Use-of-uninitialized-value Crash state: jscreatefunction JSEvalInternal JSEvalObject...

OSV-2025-1001 Dynamic-stack-buffer-overflow in _ox_err_set_with_location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=470447384 Crash type: Dynamic-stack-buffer-overflow READ 1 Crash state: oxerrsetwithlocation readtext readelement...

OSV-2025-970 Heap-buffer-overflow in check_sync_pes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=465802762 Crash type: Heap-buffer-overflow READ Crash state: checksyncpes Demux demuxprocessstream...