OSV-2020-570 Global-buffer-overflow in decode_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13542 Crash type: Global-buffer-overflow READ 4 Crash state: decodetlv dissectnoe calldissectorwork...

OSV-2020-528 Stack-buffer-overflow in ot::Message::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17330 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Message::Read ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-406 Global-buffer-overflow in lwan_strbuf_append_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18448 Crash type: Global-buffer-overflow READ Crash state: lwanstrbufappendstr parsesection parsesectionshorthand...

OSV-2020-369 UNKNOWN READ in ot::TimerScheduler::Remove

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13383 Crash type: UNKNOWN READ Crash state: ot::TimerScheduler::Remove ot::Mle::Mle::Stop otThreadSetEnabled...

OSV-2020-325 Stack-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15159 Crash type: Stack-buffer-overflow READ Crash state: std::1::basicstring, std::1::allocatorch nccfdriver::attrf nccfdriver::getCFVersion...

OSV-2020-315 Heap-buffer-overflow in r_str_utf8_codepoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18122 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf8codepoint rstrcharfullwidth rstrlenutf8...

OSV-2020-279 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18562 Crash type: Global-buffer-overflow READ 3 Crash state: lexmultilinestring lexnext parsekeyvalue...

OSV-2020-261 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18744 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2WithCtx...

OSV-2020-170 Heap-buffer-overflow in populate_relocs_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21850 Crash type: Heap-buffer-overflow WRITE 4 Crash state: populaterelocsrecord relocs rbinobjectsetitems...

OSV-2020-154 Heap-buffer-overflow in search_valid_dns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21263 Crash type: Heap-buffer-overflow READ 1 Crash state: searchvaliddns ndpisearchdns checkndpiudpflowfunc...

OSV-2020-133 Heap-use-after-free in r_bin_object_rebuild_classes_ht

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21602 Crash type: Heap-use-after-free READ 8 Crash state: rbinobjectrebuildclassesht rbinobjectsetitems rbinobjectnew...

OSV-2020-131 Heap-buffer-overflow in pixGetRGBComponentCmap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22295 Crash type: Heap-buffer-overflow READ 1 Crash state: pixGetRGBComponentCmap pixGetRGBComponent pixUnsharpMasking...

OSV-2020-88 Segv on unknown address in cbor_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21386 Crash type: Segv on unknown address Crash state: cbordecref cbordecref cborload...

OSV-2020-60 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20109 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo getndpiflowinfo6 packetprocessing...

OSV-2020-66 Heap-buffer-overflow in CPLErr GDALResampleChunk32R_AverageT<unsigned char, int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21558 Crash type: Heap-buffer-overflow READ 1 Crash state: CPLErr GDALResampleChunk32RAverageT GDALResampleChunk32RAverage GDALRasterBand::RasterIOResampled...

OSV-2020-67 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21348 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2026-1274 Heap-buffer-overflow in md_analyze_inlines

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=560657993 Crash type: Heap-buffer-overflow READ 4 Crash state: mdanalyzeinlines mdprocessnormalblockcontents mdprocessallblocks...

OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...

OSV-2026-886 Heap-buffer-overflow in ihevcd_fmt_conv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520748344 Crash type: Heap-buffer-overflow WRITE 8 Crash state: ihevcdfmtconv ihevcddecode Codec::decodeFrame...

OSV-2026-855 Heap-use-after-free in gf_sg_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519588196 Crash type: Heap-use-after-free READ 8 Crash state: gfsgreset gfsgdel fuzzscene.c...

OSV-2026-796 UNKNOWN READ in processXDR

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515065185 Crash type: UNKNOWN READ Crash state: processXDR nmeaparse genericparseinput...

OSV-2026-743 UNKNOWN READ in persist_target.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513282269 Crash type: UNKNOWN READ Crash state: persisttarget.c...

OSV-2026-623 Use-of-uninitialized-value in Mat_PrintNumber

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903317 Crash type: Use-of-uninitialized-value Crash state: MatPrintNumber MatPrintData MatVarPrint...

OSV-2026-565 Heap-buffer-overflow in xmlFAParsePosCharGroup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=501547873 Crash type: Heap-buffer-overflow READ 1 Crash state: xmlFAParsePosCharGroup xmlFAParseCharGroup xmlFAParseCharGroup...

OSV-2026-563 UNKNOWN READ in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=501547869 Crash type: UNKNOWN READ Crash state: bfdgetl32 m32relflo16reloc bfdperformrelocation...

OSV-2026-481 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=496552925 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

OSV-2026-386 Use-of-uninitialized-value in pcpp::byteArrayToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=491288647 Crash type: Use-of-uninitialized-value Crash state: pcpp::byteArrayToHexString pcpp::PacketTrailerLayer::toString FuzzTarget.cpp...

OSV-2026-311 UNKNOWN READ in strncasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponentstringtokind parsevcard...

OSV-2026-215 UNKNOWN READ in getTypeCacheHashTableBucket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482748215 Crash type: UNKNOWN READ Crash state: getTypeCacheHashTableBucket usbd.h...

OSV-2026-209 Use-of-uninitialized-value in ntrip_parse_url

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482281265 Crash type: Use-of-uninitialized-value Crash state: ntripparseurl FuzzClient.c...

OSV-2026-177 Security exception in org.apache.poi.util.IOUtils.safelyAllocate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479908886 Crash type: Security exception Crash state: org.apache.poi.util.IOUtils.safelyAllocate org.apache.poi.hssf.record.RecordInputStream.readRemainder org.apache.poi.hssf.record.UnknownRecord...

OSV-2026-176 Container-overflow in std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479922666 Crash type: Container-overflow READ Crash state: std::1::vector, std:: void std::1::vector, fillcommonheader...

OSV-2025-1068 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479873902 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringLatin1.newString java.base/java.lang.StringBuilder.toString...

OSV-2026-156 Segv on unknown address in aivdm_analyze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=478021379 Crash type: Segv on unknown address Crash state: aivdmanalyze gpsdpoll FuzzDrivers.c...

OSV-2026-128 UNKNOWN READ in rapidjson::internal::DigitGen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477993729 Crash type: UNKNOWN READ Crash state: rapidjson::internal::DigitGen rapidjson::internal::Grisu2 rapidjson::Writer, rapidjso...

OSV-2026-65 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476179553 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop java.base/sun.nio.cs.UTF8$Encoder.encodeLoop...

OSV-2025-884 Heap-use-after-free in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458199402 Crash type: Heap-use-after-free READ 8 Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-852 Heap-buffer-overflow in std::__1::pair<int, arrow::util::RleBitPackedParser::ControlFlow> arrow::util::R

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454097865 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::pair arrow::util::R arrow::util::RleBitPackedDecoder::GetBatch auto parquet::DictByteArrayDecoderImpl::DecodeArrowDense...

OSV-2025-633 UNKNOWN WRITE in _lou_handlePassVariableAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438413376 Crash type: UNKNOWN WRITE Crash state: louhandlePassVariableAction passDoAction translateString...

OSV-2025-619 Heap-buffer-overflow in webvtt_domnode_SelectNodesInTree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437537868 Crash type: Heap-buffer-overflow READ 1 Crash state: webvttdomnodeSelectNodesInTree webvttdomnodeSelectNodesInTree webvttdomnodeSelectNodesInTree...

OSV-2025-491 Heap-buffer-overflow in libssl.soNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=427814448 Crash type: Heap-buffer-overflow READ 5 Crash state: libssl.soNUMBER libssl.soNUMBER SSLCTXsetcipherlist...

OSV-2025-469 Use-of-uninitialized-value in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424653416 Crash type: Use-of-uninitialized-value Crash state: ndpistrdup ndpidetectionprocesspacket fuzzconfig.cpp...

OSV-2025-255 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407817254 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/java.lang.String.equals com.github.javaparser.utils.LineSeparator.lookup...

OSV-2025-253 Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken...

OSV-2025-63 Stack-buffer-underflow in gs_type1_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391934080 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype1interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2025-51 Heap-buffer-overflow in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390788198 Crash type: Heap-buffer-overflow WRITE Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

OSV-2024-1330 Heap-buffer-overflow in zoom_search_again

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=379072455 Crash type: Heap-buffer-overflow READ 1 Crash state: zoomsearchagain ndpidetectionprocesspacket ndpiworkflowprocesspacket...

OSV-2024-1261 Stack-buffer-overflow in _pcre2_compile_class_not_nested_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=376515526 Crash type: Stack-buffer-overflow WRITE 2 Crash state: pcre2compileclassnotnested16 compileclassoperand pcre2compileclassnested16...

OSV-2024-1031 Use-of-uninitialized-value in Http3FrameFactory::create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537939 Crash type: Use-of-uninitialized-value Crash state: Http3FrameFactory::create Http3FrameFactory::fastcreate fuzzhttp3frame.cc...

OSV-2024-867 Use-of-uninitialized-value in std::__1::ostreambuf_iterator<char, std::__1::char_traits<char>> std::__1::__pad

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68801 Crash type: Use-of-uninitialized-value Crash state: std::1::ostreambufiterator std::1::pad std::1::basicostream& std::1::putchar ostream...