libxml2:api: Stack-buffer-overflow in xmlValidateElementContent

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6179328546635776 Project: libxml2 Fuzzing Engine: honggfuzz Fuzz Target: api Job Type: honggfuzzasanlibxml2 Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7f4528e028...

OSV-2025-63 Stack-buffer-underflow in gs_type1_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391934080 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype1interpret copiedtype1glyphoutline gsdefaultglyphinfo...

llvm:llvm-parse-assembly-fuzzer: Heap-buffer-overflow in llvm::LLParser::PerFunctionState::PerFunctionState

Detailed Report: https://oss-fuzz.com/testcase?key=5309886774181888 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-parse-assembly-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x515000025f64 Crash State:...

rdkit:mol_data_stream_to_mol_fuzzer: Crash in RDKit::Dict::reset

Project: https://github.com/rdkit/rdkit.git Detailed Report: https://oss-fuzz.com/testcase?key=4784563116638208 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerubsanrdkit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00003c000000...

libconfig:config_read_fuzzer: Stack-buffer-overflow in config_setting_get_member

Project: https://github.com/hyperrealm/libconfig.git Detailed Report: https://oss-fuzz.com/testcase?key=6621525259649024 Project: libconfig Fuzzing Engine: libFuzzer Fuzz Target: configreadfuzzer Job Type: libfuzzerasanlibconfig Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash...

ffmpeg:ffmpeg_dem_MLV_fuzzer: Heap-buffer-overflow in get_packet_lj92

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5746746587676672 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegdemMLVfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address:...

OSV-2024-1424 Heap-buffer-overflow in extract_candidate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391689728 Crash type: Heap-buffer-overflow READ 8 Crash state: extractcandidate parsesdpsession parsemixedcontent...

apache-logging-log4cxx:PatternParserFuzzer: Global-buffer-overflow in log4cxx::helpers::StringHelper::equalsIgnoreCase

Detailed Report: https://oss-fuzz.com/testcase?key=6135006732288000 Project: apache-logging-log4cxx Fuzzing Engine: libFuzzer Fuzz Target: PatternParserFuzzer Job Type: libfuzzerasanapache-logging-log4cxx Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x563c9bc7bbe5...

libconfig:config_read_fuzzer: Crash in fuzz_data_path

Project: https://github.com/hyperrealm/libconfig.git Detailed Report: https://oss-fuzz.com/testcase?key=4713276390309888 Project: libconfig Fuzzing Engine: honggfuzz Fuzz Target: configreadfuzzer Job Type: honggfuzzasanlibconfig Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

Use after free in janet_sweep

With the following new fuzz target generated by https://github.com/google/oss-fuzz-gen: include include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size / init Janet / janetinit; JanetTable env = janetcoreenvNULL; const char sourcePath = "fuzzdostring"; Janet out; if size 0 / Ensur...

xpdf: Heap-buffer-overflow in ZxDoc::parse

With the following new fuzz target generated by https://github.com/google/oss-fuzz-gen: include include include include include include include "/src/xpdf-4.05/xpdf/Zoox.h" extern "C" int LLVMFuzzerTestOneInputconst uint8t data, sizet size FuzzedDataProvider fdpdata, size; std::string filename =...

OSV-2025-51 Heap-buffer-overflow in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390788198 Crash type: Heap-buffer-overflow WRITE Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

OSV-2025-50 Heap-double-free in r_crbtree_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390503425 Crash type: Heap-double-free Crash state: rcrbtreefree rbinobjectfree rbinfilefree...

inchi:inchi_input_fuzzer: Stack-buffer-overflow in mark_alt_bonds_and_taut_groups

Project: https://github.com/IUPAC-InChI/InChI.git Detailed Report: https://oss-fuzz.com/testcase?key=5095460780441600 Project: inchi Fuzzing Engine: afl Fuzz Target: inchiinputfuzzer Job Type: aflasaninchi Platform Id: linux Crash Type: Stack-buffer-overflow READ 2 Crash Address: 0x7d49dda06030...

CVE-2024-57917 topology: Keep the cpumask unchanged when printing cpumap

In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values 15 and 11 from vsnprintf"%pbl ", ... test:keyward is WARNING in kvasprintf WARNING: CPU:...

CVE-2024-57917 topology: Keep the cpumask unchanged when printing cpumap

In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values 15 and 11 from vsnprintf"%pbl ", ... test:keyward is WARNING in kvasprintf WARNING: CPU:...

CVE-2024-57917

CVE-2024-57917 : In the Linux kernel, the cpumask may be modified during printing of cpumap, causing mismatched lengths in kvasprintf-based formatting. The fix caches the cpumask to a temporary variable before cpumap_print_{list, cpumask}_to_buf() to keep it unchanged during printing. Impact is p...

OSV-2025-45 Security exception in POIHDGFFuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390461322 Crash type: Security exception Crash state: POIHDGFFuzzer...

OSV-2025-42 Heap-use-after-free in r_list_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390467754 Crash type: Heap-use-after-free READ 8 Crash state: rlistfree rbinbfltfree rbinfilefree...

radare2:ia_fuzz: Heap-double-free in r_crbtree_free

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=6660280636997632 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-double-free...