clusterfuzz v2.33.14

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

OSV-2026-1064 Heap-buffer-overflow in _wcsnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533963816 Crash type: Heap-buffer-overflow READ 2 Crash state: wcsnlen railreadunicodestring railreadhighcontrast...

PYSEC-2026-2773 Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)

Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details A second variant of the nAtoms out-of-bounds write in the ORCA reader: a different malformed-input path produced the same class of write past the end of the...

PYSEC-2026-2787 Open Babel has uninitialized pointer dereference in GRO residue parser

Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the residue handling of the GRO reader. A malformed record caused the parser to use a residue pointer that had never been...

Open Babel has uninitialized pointer dereference in PQS pFormat

SummaryA memory-safety vulnerability in Open Babel's PQS parser caused anuninitialized pointer dereference when reading a crafted input file. DetailsThe flaw was in the pFormat handling of the PQS reader. A malformedinput caused the parser to dereference a format pointer that hadnever been...

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

SummaryA memory-safety vulnerability in Open Babel's SMILES parser caused aheap buffer overflow when reading a crafted input string. DetailsThe flaw was in OBSmilesParser::ParseSmiles. A malformed SMILESinput caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is a...

PYSEC-2026-2789 Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Summary A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been...

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda heap buffer overflow when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::CheckSpecies. A malformed speciesrecord caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is ...

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

SummaryA memory-safety vulnerability in Open Babel's GAMESS output parsercaused a use-after-free when reading a crafted input file. DetailsThe flaw was in GAMESSOutputFormat::ReadMolecule. A malformed inputcaused the parser to dereference a stale pointer after the underlyingobject had been freed...

PYSEC-2026-2791 Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Summary A memory-safety vulnerability in Open Babel's CDXML file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::GetExplicitValence as called from the CDXML parser. A malformed fragment caused the parser to invoke the method on a...

PT-2026-59412

Summary A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt...

PT-2026-59424

Summary A memory-safety vulnerability in Open Babel's PQS parser caused an out-of-bounds pre-buffer read when reading a crafted input file. Details The flaw was in the lowerit helper used by the PQS parser. A malformed input caused the helper to read one or more bytes before the start of its inpu...

freerdp:TestFuzzChannelRail: Heap-buffer-overflow in _wcsnlen

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5268164724981760 Project: freerdp Fuzzing Engine: libFuzzer Fuzz Target: TestFuzzChannelRail Job Type: libfuzzerasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

OSV-2026-1054 Heap-buffer-overflow in ihevcd_cabac_decode_bins_tunary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533053032 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdcabacdecodebinstunary ihevcdparsetransformtree ihevcdparsetransformtree...

ghostscript:gs_xps_fuzzer: Stack-buffer-overflow in do_impl_process

Detailed Report: https://oss-fuzz.com/testcase?key=6370797451804672 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsxpsfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Address: 0x7aa78b3dbdb0 Crash State: doimplprocess...

mruby:mruby_fuzzer: Heap-buffer-overflow in codegen

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6308929387429888 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7ae43fae00e0 Crash State:...

OSV-2026-1043 Index-out-of-bounds in impd_drc_gen_instructions_derived_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531676895 Crash type: Index-out-of-bounds Crash state: impddrcgeninstructionsderiveddata impdparsedrcconfig impddrcinit...

OSV-2026-1039 Index-out-of-bounds in iusace_estimate_scfs_chan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531479957 Crash type: Index-out-of-bounds Crash state: iusaceestimatescfschan iusacequantizespec iusacefdencode...

OSV-2026-1033 Heap-buffer-overflow in ppp_tx_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531087610 Crash type: Heap-buffer-overflow READ Crash state: ppptxframe ppprx mgtcpiprx...

assimp:assimp_fuzzer: Crash in Assimp::MDL::HalfLife::HL1MDLLoader::read_animations

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4786852619157504 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzermsanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x724000040001 Crash State...