CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption src/if-options.c:1886, the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state caus...

gpac:fuzz_scene: Heap-use-after-free in gf_node_unregister

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5296567427596288 Project: gpac Fuzzing Engine: honggfuzz Fuzz Target: fuzzscene Job Type: honggfuzzasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7692f7fe0050 Crash...

TechMyst-Toolkit

TechMyst-Toolkit "An automated Bug...

Investigating Metamorphic Fuzz Oracle Enhancement Via Large Language Models

Fuzz drivers are essential components of greybox fuzzing, as they encapsulate target interfaces, define test spaces, and largely determine fuzzing effectiveness. Existing fuzz drivers typically rely on crash-based oracles for security testing, overlooking library functionality and limiting bug...

DIG: Oracle-Guided Directed Input Generation for One-Day Vulnerabilities

One-day vulnerabilities pose significant risks due to delayed or incomplete patch adoption. Generating proof-of-concept PoC inputs is therefore essential for assessing real-world impact. The key challenge is identifying necessary constraints for triggering the vulnerability and solving them...

solidity:yul_proto_diff_custom_mutate_ossfuzz: Segv on unknown address in solidity::yul::test::ExpressionEvaluator::evaluateArgs

Detailed Report: https://oss-fuzz.com/testcase?key=5135205976047616 Project: solidity Fuzzing Engine: afl Fuzz Target: yulprotodiffcustommutateossfuzz Job Type: aflasansolidity Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

cmake:cmArchiveExtractFuzzer: Use-of-uninitialized-value in cab_read_ahead_cfdata

Project: https://gitlab.kitware.com/cmake/cmake.git Detailed Report: https://oss-fuzz.com/testcase?key=5912907245486080 Project: cmake Fuzzing Engine: libFuzzer Fuzz Target: cmArchiveExtractFuzzer Job Type: libfuzzermsancmake Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

libredwg:llvmfuzz: Heap-buffer-overflow in decode_R13_RNUMBER

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5160543060295680 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

OSV-2026-880 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520660538 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

quickjs:fuzz_compile: Use-of-uninitialized-value in JS_DefineProperty

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=4646730619748352 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcompile Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type:...

gpac:fuzz_scene: Crash in gf_node_list_add_child

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6566986070163456 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00009fffa010 Crash State: gfnodelistaddchild...

PT-2026-47173

$1,000 of compute found 21 zero-days in FFmpeg. An autonomous agent called depthfirst scanned roughly 1.5 million lines of C, then wrote a reproducible proof-of-concept for every bug it reported. The shift is that second half. Not a list of suspicious lines for a human to chase, but 21 crashing...

flyway:LocationFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

Project: https://github.com/flyway/flyway.git Detailed Report: https://oss-fuzz.com/testcase?key=4621606134808576 Project: flyway Fuzzing Engine: libFuzzer Fuzz Target: LocationFuzzer Job Type: libfuzzerasanflyway Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

libvpx:vpx_enc_fuzzer_vp8_nalloc: Use-of-uninitialized-value in vp8_regular_quantize_b_sse4_1

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=4581817557778432 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8nalloc Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

PT-2026-49159

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519588196 Crash type: Heap-use-after-free READ 8 Crash state: gf sg reset gf sg del fuzz scene.c...

FIFOFox: Windows Named-Pipe Security Auditor and Fuzzer

FIFOFox is a Windows named-pipe security assessment tool for identifying weak pipe permissions, pipe-squatting exposure, and named-pipe impersonation attack paths. It combines passive auditing with authorized active testing, including fuzzing and interception-style capture, to help defenders find...

apache-poi:POIFileHandlerFuzzer: Security exception in org.apache.poi.hemf.record.emf.HemfMisc$EmfExtCreatePen.init

Detailed Report: https://oss-fuzz.com/testcase?key=6348265548480512 Project: apache-poi Fuzzing Engine: libFuzzer Fuzz Target: POIFileHandlerFuzzer Job Type: libfuzzerasanapache-poi Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

mruby:mruby_fuzzer: Negative-size-param in bt_match

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5685642238689280 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: btmatch btmatch btmatch...

apache-logging-log4cxx:TranscoderFuzzer-wchar_t: Stack-buffer-overflow in log4cxx::helpers::Transcoder::decode

Detailed Report: https://oss-fuzz.com/testcase?key=4974813507813376 Project: apache-logging-log4cxx Fuzzing Engine: centipede Fuzz Target: TranscoderFuzzer-wchart Job Type: centipedeasanapache-logging-log4cxx Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7b2b222daa1...

OSV-2026-837 Heap-use-after-free in grk::TileProcessor::parseTilePart

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519348401 Crash type: Heap-use-after-free READ 8 Crash state: grk::TileProcessor::parseTilePart tf::Executor::invoke tf::Executor::spawn...