OSV-2020-424 Heap-buffer-overflow in sav_parse_long_string_missing_values_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13076 Crash type: Heap-buffer-overflow READ 1 Crash state: savparselongstringmissingvaluesrecord savparserecordspass2 readstatparsesav...

OSV-2020-408 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14428 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse test...

OSV-2020-391 Use-of-uninitialized-value in mprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13453 Crash type: Use-of-uninitialized-value Crash state: mprint match filesoftmagic...

OSV-2020-384 Heap-buffer-overflow in agentx_parse_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14481 Crash type: Heap-buffer-overflow READ Crash state: agentxparsestring agentxparse agentxparsefuzzer.c...

OSV-2020-364 Stack-use-after-return in ihevcd_process_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17601 Crash type: Stack-use-after-return READ 4 Crash state: ihevcdprocessthread clone...

OSV-2020-357 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12685 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 dexmethodsignature2 dexparsedebugitem...

OSV-2020-336 Stack-buffer-overflow in ot::NetworkData::PrefixTlv::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12589 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::PrefixTlv::Init ot::NetworkData::Local::AddOnMeshPrefix otError ot::Ncp::NcpBase::HandlePropertyInsert...

OSV-2020-287 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13882 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype configparsenetcondition nextassignment...

OSV-2020-280 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15458 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-245 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23046 Crash type: Heap-use-after-free READ 3 Crash state: ndpihttpcheckcontent checkcontenttypeandchangeprotocol ndpicheckhttptcp...

OSV-2020-236 Heap-buffer-overflow in get_ndpi_flow_info6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20091 Crash type: Heap-buffer-overflow READ 4 Crash state: getndpiflowinfo6 packetprocessing ndpiworkflowprocesspacket...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-231 UNKNOWN WRITE in gen_mftr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20081 Crash type: UNKNOWN WRITE Crash state: genmftr...

OSV-2020-215 Use-of-uninitialized-value in xmlStrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23144 Crash type: Use-of-uninitialized-value Crash state: xmlStrdup xmlRaiseError xmlErrValidNode...

OSV-2020-208 Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22235 Crash type: Use-of-uninitialized-value Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2020-200 Heap-buffer-overflow in spng_decode_scanline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22595 Crash type: Heap-buffer-overflow WRITE 2 Crash state: spngdecodescanline spngdecoderow spngdecodeimage...

OSV-2020-188 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20924 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-189 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21718 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen dissectlspextipreachabilityclv isisdissectclvs...

OSV-2020-164 Stack-buffer-overflow in ot::NetworkData::NetworkData::FindService

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21762 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::NetworkData::FindService ot::NetworkData::Leader::Validate ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-150 Segv on unknown address in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20457 Crash type: Segv on unknown address Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch wabt::BinaryReaderIR::OnDataSymbol...

OSV-2020-114 Use-of-uninitialized-value in read_non_idat_chunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22646 Crash type: Use-of-uninitialized-value Crash state: readnonidatchunks readchunks spnggetplte...

OSV-2020-70 Heap-buffer-overflow in ndpi_handle_ipv6_extension_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21719 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpihandleipv6extensionheaders ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-42 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20695 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-3 UNKNOWN WRITE in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22962 Crash type: UNKNOWN WRITE Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2026-1220 Use-of-uninitialized-value in str_escape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=554268877 Crash type: Use-of-uninitialized-value Crash state: strescape mrbvmexec yieldwithattr...

OSV-2026-1110 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrbbasicallocfunc pmnodehashinsert...

OSV-2026-933 UNKNOWN READ in aiMesh::~aiMesh

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=524387782 Crash type: UNKNOWN READ Crash state: aiMesh::aiMesh Assimp::ASEImporter::InternReadFile Assimp::BaseImporter::ReadFile...

OSV-2026-765 Heap-use-after-free in gf_node_get_id

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513783541 Crash type: Heap-use-after-free READ 8 Crash state: gfnodegetid lsrreadcommandlist lsrdecodelaserunit...

OSV-2026-733 Use-of-uninitialized-value in JBIG2Stream::readSymbolDictSeg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512468082 Crash type: Use-of-uninitialized-value Crash state: JBIG2Stream::readSymbolDictSeg JBIG2Stream::readSegments JBIG2Stream::rewind...

OSV-2026-630 Use-of-uninitialized-value in JXRHandlerPrivate::readTextMeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506459935 Crash type: Use-of-uninitialized-value Crash state: JXRHandlerPrivate::readTextMeta JXRHandlerPrivate::description JXRHandlerPrivate::setMetadata...

OSV-2026-579 Heap-buffer-overflow in CEA708_DTVCC_Demuxer_Push

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=502906444 Crash type: Heap-buffer-overflow READ 1 Crash state: CEA708DTVCCDemuxerPush DoDecode Decode...

OSV-2026-246 Use-of-uninitialized-value in printAddressingMode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=484248078 Crash type: Use-of-uninitialized-value Crash state: printAddressingMode M68KprintInst csdisasm...

OSV-2026-203 Segv on unknown address in glslang::TIntermediate::addSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=481635421 Crash type: Segv on unknown address Crash state: glslang::TIntermediate::addSymbol glslang::HlslParseContext::handleFunctionCall glslang::HlslParseContext::transformEntryPoint...

OSV-2026-169 Null-dereference READ in execute_post_instantiate_functions

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479872443 Crash type: Null-dereference READ Crash state: executepostinstantiatefunctions wasminstantiate wasmruntimeinstantiate...

OSV-2025-970 Heap-buffer-overflow in check_sync_pes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=465802762 Crash type: Heap-buffer-overflow READ Crash state: checksyncpes Demux demuxprocessstream...

OSV-2025-876 Stack-buffer-overflow in snmp_input

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457106694 Crash type: Stack-buffer-overflow READ 8 Crash state: snmpinput snmpparsetrapfuzzer.c...

OSV-2025-858 Use-of-uninitialized-value in pcpp::byteArrayToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454944849 Crash type: Use-of-uninitialized-value Crash state: pcpp::byteArrayToHexString pcpp::PacketTrailerLayer::toString FuzzTarget.cpp...

OSV-2025-834 Heap-buffer-overflow in std::__1::pair<int, arrow::util::RleBitPackedParser::ControlFlow> arrow::util::R

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=451150486 Crash type: Heap-buffer-overflow READ 3 Crash state: std::1::pair arrow::util::R arrow::util::RleBitPackedDecoder::GetBatch auto parquet::DictByteArrayDecoderImpl::DecodeArrowDense...

OSV-2025-787 Heap-buffer-overflow in DwaCompressor_uncompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447429458 Crash type: Heap-buffer-overflow WRITE Crash state: DwaCompressoruncompress internalexrundodwaa exruncompresschunk...

OSV-2025-723 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=444547710 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processtls fuzzquicgetcryptodata.c...

OSV-2025-631 Null-dereference READ in [email protected]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438264629 Crash type: Null-dereference READ Crash state: [email protected]...

OSV-2025-512 Invalid-free in pdf_decodestream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754704 Crash type: Invalid-free Crash state: pdfdecodestream pdfextractobj clipdf...

OSV-2025-352 Use-of-uninitialized-value in JS_FreeRuntime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=416299802 Crash type: Use-of-uninitialized-value Crash state: JSFreeRuntime fuzzeval.c asyncfuncinit...

OSV-2025-346 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=416298149 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal JSEvalFunctionInternal JSEvalInternal...

OSV-2025-300 Negative-size-param in recurse_update_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413078692 Crash type: Negative-size-param Crash state: recurseupdateoffsets match pcre2match8...

OSV-2025-275 UNKNOWN READ in void std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::__cons

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=410115359 Crash type: UNKNOWN READ Crash state: void std::1::vector::cons Poco::Net::NTLMCredentials::parseChallengeMessage Poco::Net::HTTPNTLMCredentials::createNTLMMessage...

OSV-2025-262 UNKNOWN WRITE in _lou_handlePassVariableAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=408523839 Crash type: UNKNOWN WRITE Crash state: louhandlePassVariableAction passDoAction translateString...

OSV-2025-256 Global-buffer-overflow in QByteArray::QByteArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=408025086 Crash type: Global-buffer-overflow READ 15 Crash state: QByteArray::QByteArray KZip::openArchive KArchive::open...

OSV-2025-240 Security exception in com.powsybl.commons.xml.XmlUtil.lambda$skipSubElements$0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=406332767 Crash type: Security exception Crash state: com.powsybl.commons.xml.XmlUtil.lambda$skipSubElements$0 com.powsybl.commons.xml.XmlUtil.readSubElements com.powsybl.commons.xml.XmlUtil.skipSubElements...

OSV-2025-202 UNKNOWN READ in _blit_xrgb32_lerp_spans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=402836107 Crash type: UNKNOWN READ Crash state: blitxrgb32lerpspans cairorectangularscanconvertergenerate compositeboxes...