ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents

Tool-augmented LLM agents increasingly rely on multi-step, multi-tool workflows to complete real tasks. This design expands the attack surface, because data produced by one tool can be persisted and later reused as input to another tool, enabling exploitable source-to-sink dataflows that only...

u-boot:fuzz_image_decomp: Heap-buffer-overflow in lzmaBuffToBuffDecompress

Detailed Report: https://oss-fuzz.com/testcase?key=5019466785423360 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzimagedecomp Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7726fc3e00b6 Crash State: lzmaBuffToBuffDecompress...

apache-poi:POIFileHandlerFuzzer: Security exception in org.apache.poi.hemf.record.emf.HemfDraw$EmfPolyDraw.init

Detailed Report: https://oss-fuzz.com/testcase?key=6368629896839168 Project: apache-poi Fuzzing Engine: libFuzzer Fuzz Target: POIFileHandlerFuzzer Job Type: libfuzzerasanapache-poi Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

RUSTSEC-2026-0037 Denial of service in Quinn endpoints

Receiving QUIC transport parameters containing invalid values could lead to a panic. Unfortunately the maintainers did not properly assess usage of unwrap calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a...

Denial of service in Quinn endpoints

Receiving QUIC transport parameters containing invalid values could lead to a panic. Unfortunately the maintainers did not properly assess usage of unwrap calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_min_scan

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5917407612043264 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

openjph:ojph_expand_fuzz_target: Use-of-uninitialized-value in ojph::local::tile::finalize_alloc

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5205194525966336 Project: openjph Fuzzing Engine: libFuzzer Fuzz Target: ojphexpandfuzztarget Job Type: libfuzzermsanopenjph Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing

Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid API invocations. Manual harness creation is time-consuming and requires deep understanding of API semantics,...

OSS-CRS: Liberating AIxCC Cyber Reasoning Systems for Real-World Open-Source Security

DARPA's AI Cyber Challenge AIxCC showed that cyber reasoning systems CRSs can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their...

Plasma

Plasma !Pythonhttps://img.shields.io/badge/python-3.10%2B-...

tinyobjloader:fuzz_ParseFromString: Heap-buffer-overflow in tinyobj::tryParseDouble

Project: https://github.com/tinyobjloader/tinyobjloader.git Detailed Report: https://oss-fuzz.com/testcase?key=5352302256128000 Project: tinyobjloader Fuzzing Engine: libFuzzer Fuzz Target: fuzzParseFromString Job Type: libfuzzerasantinyobjloader Platform Id: linux Crash Type: Heap-buffer-overflo...

ffmpeg:ffmpeg_dem_AIFF_fuzzer: Use-of-uninitialized-value in aiff_read_header

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6406386140643328 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemAIFFfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

SemFuzz: A Semantics-Aware Fuzzing Framework for Network Protocol Implementations

Network protocols are the foundation of modern communication, yet their implementations often contain semantic vulnerabilities stemming from inadequate understanding of specification semantics. Existing gray-box and black-box testing approaches lack semantic modeling of protocols, making it...

cups:fuzz_cups: Heap-buffer-overflow in _cupsRasterAddError

Project: https://github.com/OpenPrinting/cups.git Detailed Report: https://oss-fuzz.com/testcase?key=4517534425743360 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: fuzzcups Job Type: libfuzzerasancups Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 3 Crash Address: 0x7a86bd3e04a2...

Challenges and Design Considerations for Finding CUDA Bugs through GPU-Native Fuzzing

Modern computing is shifting from homogeneous CPU-centric systems to heterogeneous systems with closely integrated CPUs and GPUs. While the CPU software stack has benefited from decades of memory safety hardening, the GPU software stack remains dangerously immature. This discrepancy presents a...

On the Effectiveness of Mutational Grammar Fuzzing

Posted by Ivan Fratric Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the...

Adobe SDK 1.7.1 2410 Overflow Analysis / Fuzzing Model

This Python script implements a comprehensive framework to model, detect, and analyze integer overflows in 32-bit arithmetic, particularly in the context of image memory allocation. The framework combines formal methods, stepwise arithmetic, symbolic execution, SMT-style constraint solving,...

OSV-2026-343 Heap-buffer-overflow in pcre2_compile_32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488713937 Crash type: Heap-buffer-overflow WRITE 4 Crash state: pcre2compile32 pcre2fuzzsupport.c...

libraw:libraw_raf_fuzzer: Index-out-of-bounds in LibRaw::ppg_interpolate

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=4914355312590848 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawraffuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

inchi:inchi_input_fuzzer: Stack-use-after-return in mark_alt_bonds_and_taut_groups

Project: https://github.com/IUPAC-InChI/InChI.git Detailed Report: https://oss-fuzz.com/testcase?key=5675955004964864 Project: inchi Fuzzing Engine: afl Fuzz Target: inchiinputfuzzer Job Type: aflasaninchi Platform Id: linux Crash Type: Stack-use-after-return READ 2 Crash Address: 0x78abf90d3fa2...