wtf v0.5.8

what the fuzz A distributed, code-coverage guided, cross-platform snapshot-based fuzzer designed for attacking user and or kernel-mode targets running on Microsoft Windows and Linux user-mode experimental!. Overview what the fuzz or wtf is a distributed, code-coverage guided, customizable,...

OSV-2026-1220 Use-of-uninitialized-value in str_escape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=554268877 Crash type: Use-of-uninitialized-value Crash state: strescape mrbvmexec yieldwithattr...

OSV-2026-1210 Heap-buffer-overflow in decode_get_histogram_format_resp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=553267079 Crash type: Heap-buffer-overflow READ 1 Crash state: decodegethistogramformatresp decodegethistogramformatrespfuzzer.cc...

OSV-2026-1189 Global-buffer-overflow in oidc_cfg_redirect_urls_allowed_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=550474749 Crash type: Global-buffer-overflow READ 8 Crash state: oidccfgredirecturlsallowedget oidcvalidateredirecturl fuzzurl.c...

ANT-2026-ZRDQDR79 · util-linux · heap-use-after-free

use-after-free medium CVE-2026-13595 GHSA-qpmf-9p9c-455w Severity Claude critical · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-ZRDQDR79:...

OSV-2026-1157 Memcpy-param-overlap in zxc_decompress_chunk_wrapper_default

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=546426939 Crash type: Memcpy-param-overlap Crash state: zxcdecompresschunkwrapperdefault zxcdecompressframe fuzzdecompress.c...

php:php-fuzz-function-jit: Heap-use-after-free in zval_ptr_dtor_nogc

Detailed Report: https://oss-fuzz.com/testcase?key=4584750845853696 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-function-jit Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7944a94efd30 Crash State: zvalptrdtornogc...

OSV-2026-1127 Heap-buffer-overflow in read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=543583447 Crash type: Heap-buffer-overflow READ 1 Crash state: readdata zipsourcecall zipsourceread...

OSV-2026-1110 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrbbasicallocfunc pmnodehashinsert...

OSV-2026-1095 Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=540111888 Crash type: Heap-buffer-overflow READ 8 Crash state: grk::t1::CodeblockDecompressImpl::parsePacketData grk::PacketParser::readData grk::PacketParser::parsePacketData...

OSV-2026-1092 Security exception in com.github.javaparser.ast.expr.Name.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539142495 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.Name.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.lambda$visit$133 java.base/java.util.Optional.ifPresent...

OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...

SUSE CVE-2026-64326

In the Linux kernel, the following vulnerability has been resolved: block: skip syncblockdev on surprise removal in bdevmarkdead bdevmarkdead's @surprise == true means the device is already gone. The filesystem callback fsbdevmarkdead honours this and skips syncfilesystem, but the bare block devi...

Open Babel has uninitialized pointer dereference in PQS pFormat

SummaryA memory-safety vulnerability in Open Babel's PQS parser caused anuninitialized pointer dereference when reading a crafted input file. DetailsThe flaw was in the pFormat handling of the PQS reader. A malformedinput caused the parser to dereference a format pointer that hadnever been...

PYSEC-2026-2787 Open Babel has uninitialized pointer dereference in GRO residue parser

Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the residue handling of the GRO reader. A malformed record caused the parser to use a residue pointer that had never been...

PYSEC-2026-2773 Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)

Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details A second variant of the nAtoms out-of-bounds write in the ORCA reader: a different malformed-input path produced the same class of write past the end of the...

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

SummaryA memory-safety vulnerability in Open Babel's SMILES parser caused aheap buffer overflow when reading a crafted input string. DetailsThe flaw was in OBSmilesParser::ParseSmiles. A malformed SMILESinput caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is a...

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

SummaryA memory-safety vulnerability in Open Babel's GAMESS output parsercaused a use-after-free when reading a crafted input file. DetailsThe flaw was in GAMESSOutputFormat::ReadMolecule. A malformed inputcaused the parser to dereference a stale pointer after the underlyingobject had been freed...

PYSEC-2026-2791 Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Summary A memory-safety vulnerability in Open Babel's CDXML file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::GetExplicitValence as called from the CDXML parser. A malformed fragment caused the parser to invoke the method on a...

PYSEC-2026-2789 Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Summary A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been...