OSV-2026-121 Use-of-uninitialized-value in trySubset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477657796 Crash type: Use-of-uninitialized-value Crash state: trySubset hb-subset-fuzzer.cc...

PT-2026-5752

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477657796 Crash type: Use-of-uninitialized-value Crash state: trySubset hb-subset-fuzzer.cc...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in trySubset

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5920156651159552 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in graph::LigatureSubstFormat1::shrink

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6005602106277888 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_subr_subset_t, CFF::subr_subset_param_t, CFF:

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5291661985120256 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in _hb_face_builder_get_table_tags

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5721476158521344 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in hb_subset_plan_t::hb_subset_plan_t

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6696597055406080 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x5180000006...

harfbuzz:hb-subset-fuzzer: Crash in OT::glyph_variations_t::create_from_glyphs_var_data

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6032126569742336 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61d0000111db...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in CFF::Charset::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5191907895279616 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Invalid-free in hb_free_impl

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5855710991482880 Project: harfbuzz Fuzzing Engine: honggfuzz Fuzz Target: hb-subset-fuzzer Job Type: honggfuzzasanharfbuzz Platform Id: linux Crash Type: Invalid-free Crash Address: 0x619000000814...

harfbuzz:hb-subset-fuzzer: Crash in bool OT::Layout::Common::CoverageFormat2_4<OT::Layout::MediumTypes>::serialize<h

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4985737289007104 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x73e0043d383...

harfbuzz:hb-subset-fuzzer: Crash in bool OT::Layout::Common::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filt

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6512559172485120 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x62180003882...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in void sort_r_simple<>

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6425953707098112 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

harfbuzz:hb-subset-fuzzer: Crash in OT::Layout::GPOS_impl::CursivePosFormat1::subset

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4813093092589568 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x62180000657f Crash Stat...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6521393809588224 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in hb_subset_plan_t::hb_subset_plan_t

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5120246288875520 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5120727025319936 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in hb-subset-fuzzer.cc

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5222130632753152 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in OT::COLR::closure_V0palette_indices

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6572113563877376 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in hb_map_iter_t<hb_map_iter_t<hb_range_iter_t<unsigned int, unsigned int>, hb_map_

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4877336988483584 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...