OSV-2020-214 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20437 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure Variantclear...

OSV-2020-201 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22453 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-204 Negative-size-param in parquet::ColumnReaderImplBase<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20698 Crash type: Negative-size-param Crash state: parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType parquet::arrow::LeafReader::NextBatch...

OSV-2020-179 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20832 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-148 Use-of-uninitialized-value in AES_encrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23015 Crash type: Use-of-uninitialized-value Crash state: AESencrypt AESwrapkey aeswrapcipher...

OSV-2020-68 Heap-double-free in ares_parse_soa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21176 Crash type: Heap-double-free Crash state: aresparsesoareply ares-test-fuzz.c aresparsesoareply...

OSV-2020-54 Heap-buffer-overflow in OT::HintingDevice* hb_serialize_context_t::embed<OT::HintingDevice>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20211 Crash type: Heap-buffer-overflow READ Crash state: OT::HintingDevice hbserializecontextt::embed OT::HintingDevice::copy OT::Device::copy...

OSV-2020-15 UNKNOWN READ in _01inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22245 Crash type: UNKNOWN READ Crash state: 01inverse res1inverse mapping0inverse...

OSV-2020-18 Heap-buffer-overflow in ndpi_search_openvpn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22244 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpisearchopenvpn checkndpiudpflowfunc ndpidetectionprocesspacket...

OSV-2026-1297 UNKNOWN READ in janet_to_string_b

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562551214 Crash type: UNKNOWN READ Crash state: janettostringb janetformatbv janetpanicf...

OSV-2026-981 Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527773834 Crash type: Heap-buffer-overflow WRITE 4 Crash state: std::1::function::funcgrk::FileFormatJP2Decompress::FileFormatJP2Decompre std::1::function::funcgrk::CodeStreamDecompress::postMultiTile...

OSV-2026-896 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=521163865 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-879 Heap-use-after-free in lsr_restore_base

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520664955 Crash type: Heap-use-after-free READ 8 Crash state: lsrrestorebase lsrreadpolygon lsrreadscenecontentmodel...

OSV-2026-748 Heap-buffer-overflow in p11_lexer_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513102821 Crash type: Heap-buffer-overflow READ 2 Crash state: p11lexernext p11persistread p11parserformatpersist...

OSV-2026-650 Use-of-uninitialized-value in Mat_int32Swap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506942183 Crash type: Use-of-uninitialized-value Crash state: Matint32Swap ReadCompressedInt32Data MatVarRead5...

OSV-2026-582 Use-of-uninitialized-value in H5S_select_hyperslab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=502905691 Crash type: Use-of-uninitialized-value Crash state: H5Sselecthyperslab H5Dchunkioinit H5Dread...

OSV-2026-504 Heap-use-after-free in ObjectStream::getObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498251261 Crash type: Heap-use-after-free READ 4 Crash state: ObjectStream::getObject XRef::fetch XRef::fetch...

OSV-2025-1075 Stack-use-after-return in mark_alt_bonds_and_taut_groups

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488729177 Crash type: Stack-use-after-return READ 2 Crash state: markaltbondsandtautgroups CreateINChI MakeOneInChIOutOfStrFromINChI...

OSV-2026-182 Use-of-uninitialized-value in json_internal_read_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479922669 Crash type: Use-of-uninitialized-value Crash state: jsoninternalreadobject jsondeviceread FuzzClient.c...

OSV-2026-108 UNKNOWN in rapidjson::PrettyWriter<rapidjson::GenericStringBuffer<rapidjson::UTF8<char>, ra

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=477111546 Crash type: UNKNOWN Crash state: rapidjson::PrettyWriter, ra bool rapidjson::GenericValue, rapidjson::MemoryPoolAllocat bool rapidjson::GenericValue, rapidjson::MemoryPoolAllocat...

OSV-2026-105 Use-of-uninitialized-value in pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476187680 Crash type: Use-of-uninitialized-value Crash state: pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint::toString pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint::toStringAndMD5...

OSV-2026-44 UNKNOWN READ in MP4_TrackSeek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475299914 Crash type: UNKNOWN READ Crash state: MP4TrackSeek DemuxMoov Demux...

OSV-2026-6 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472785101 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.primary...

OSV-2025-1039 UNKNOWN WRITE in fuzz_regexp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471926738 Crash type: UNKNOWN WRITE Crash state: fuzzregexp...

OSV-2025-930 Dynamic-stack-buffer-overflow in _ox_err_set_with_location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462353164 Crash type: Dynamic-stack-buffer-overflow READ 1 Crash state: oxerrsetwithlocation readelement oxparse...

OSV-2025-926 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462261562 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt...

OSV-2025-797 Heap-buffer-overflow in ProcessRows

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447845730 Crash type: Heap-buffer-overflow WRITE Crash state: ProcessRows DecodeImageData VP8LDecodeImage...

OSV-2025-765 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=446027675 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/java.lang.StringUTF16.newBytesFor java.base/java.lang.StringUTF16.toBytes...

OSV-2025-718 Heap-buffer-overflow in pcpp::ArpLayer::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=443832078 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::ArpLayer::toString pcpp::Packet::toStringList pcpp::Packet::toString...

OSV-2025-657 Heap-use-after-free in ftp_pp_statemachine

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=439473053 Crash type: Heap-use-after-free READ 8 Crash state: ftpppstatemachine ftpdoing multirunsingle...

OSV-2025-589 Heap-buffer-overflow in isvcd_decode_recon_tfr_nmb_base_lyr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435086517 Crash type: Heap-buffer-overflow READ 1 Crash state: isvcddecoderecontfrnmbbaselyr isvcdparseinterslicedatacabac isvcdparsepslice...

OSV-2025-584 Heap-buffer-overflow in isvcd_mark_err_slice_skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434978682 Crash type: Heap-buffer-overflow READ 2 Crash state: isvcdmarkerrsliceskip isvcdvideodecode Codec::decodeFrame...

OSV-2025-480 Stack-buffer-overflow in void glz::from<10000u, std::__1::__bit_reference<std::__1::vector<bool, std::__1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=425725152 Crash type: Stack-buffer-overflow READ 1 Crash state: void glz::from::op::opglz::optscsv10000u,...

OSV-2025-419 Security exception in org.apache.lucene.util.AttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420955259 Crash type: Security exception Crash state: org.apache.lucene.util.AttributeImpl.clone org.apache.lucene.util.AttributeSource$State.clone org.apache.lucene.util.AttributeSource$State.clone...

OSV-2025-406 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420197344 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...

OSV-2025-357 Segv on unknown address in pcpp::Packet::computeCalculateFields

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=416808618 Crash type: Segv on unknown address Crash state: pcpp::Packet::computeCalculateFields FuzzTarget.cpp...

OSV-2025-321 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=415088961 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-215 Security exception in graphql.parser.GraphqlAntlrToLanguage.createType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=403877661 Crash type: Security exception Crash state: graphql.parser.GraphqlAntlrToLanguage.createType graphql.parser.GraphqlAntlrToLanguage.createListType graphql.parser.GraphqlAntlrToLanguage.createNonNullType...

OSV-2025-85 Segv on unknown address in ndpi_free_flow_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=393414230 Crash type: Segv on unknown address Crash state: ndpifreeflowdata fuzzprocesspacket.c...

OSV-2025-4 Heap-buffer-overflow in ___interceptor_pthread_create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=386713390 Crash type: Heap-buffer-overflow READ 8 Crash state: interceptorpthreadcreate...

OSV-2024-1406 UNKNOWN READ in _TIFFVSetField

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=385406655 Crash type: UNKNOWN READ Crash state: TIFFVSetField TIFFSetField TIFFFetchNormalTag...

OSV-2024-1375 Index-out-of-bounds in dwg_decode_eed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=383814052 Crash type: Index-out-of-bounds Crash state: dwgdecodeeed dwgdecodeentity dwgdecodeRAYprivate...

OSV-2024-1348 Heap-buffer-overflow in glslang::HlslGrammar::acceptDeclaration

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382721848 Crash type: Heap-buffer-overflow READ 1 Crash state: glslang::HlslGrammar::acceptDeclaration glslang::HlslGrammar::acceptCompilationUnit glslang::HlslParseContext::parseShaderStrings...

OSV-2024-1253 Segv on unknown address in llama_output_reserve

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=376331508 Crash type: Segv on unknown address Crash state: llamaoutputreserve llamadecode fuzztokenizer.cpp...

OSV-2024-1237 Use-of-uninitialized-value in jit_compile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=374218978 Crash type: Use-of-uninitialized-value Crash state: jitcompile pcre2jitcompile8 pcre2fuzzsupport.c...

OSV-2024-1201 Heap-buffer-overflow in polygonToCellsExperimental

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515086 Crash type: Heap-buffer-overflow WRITE 8 Crash state: polygonToCellsExperimental fuzzerPolygonToCellsExperimental.c...

OSV-2024-1191 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371931330 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

OSV-2024-1018 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67071 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2024-552 UNKNOWN READ in ndpi_search_zoom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69520 Crash type: UNKNOWN READ Crash state: ndpisearchzoom checkndpidetectionfunc ndpidetectionprocesspacket...

OSV-2024-539 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69451 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...