OSV-2024-22 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65868 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

OSV-2024-18 Heap-use-after-free in QPDF::read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65777 Crash type: Heap-use-after-free READ 8 Crash state: QPDF::readxref QPDF::reconstructxref QPDF::parse...

OSV-2023-1115 Use-of-uninitialized-value in fp_uninit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63867 Crash type: Use-of-uninitialized-value Crash state: fpuninit cryptofuzz::module::libecc::OpECCValidatePubkey cryptofuzz::ExecutorBase::callM...

OSV-2023-942 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62864 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop java.base/sun.nio.cs.CESU8$Encoder.encodeLoo...

OSV-2023-662 Security exception in org.apache.commons.io.IOUtils.byteArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61254 Crash type: Security exception Crash state: org.apache.commons.io.IOUtils.byteArray org.apache.commons.io.output.AbstractByteArrayOutputStream.needNewBuffer org.apache.commons.io.output.UnsynchronizedByteArrayOutputStrea...

OSV-2023-407 Stack-buffer-overflow in DwaCompressor_readChannelRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59070 Crash type: Stack-buffer-overflow READ Crash state: DwaCompressorreadChannelRules DwaCompressoruncompress internalexrundodwaa...

OSV-2023-257 Global-buffer-overflow in read_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57566 Crash type: Global-buffer-overflow READ 1 Crash state: readcodingunit readcodingquadtree readcodingquadtree...

OSV-2023-72 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56057 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParseTracePacketData...

OSV-2023-34 Heap-use-after-free in gc_trace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55443 Crash type: Heap-use-after-free READ 2 Crash state: gctrace gsgcreclaim ireclaim...

OSV-2022-1142 Heap-buffer-overflow in onigenc_unicode_mbc_case_fold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53030 Crash type: Heap-buffer-overflow READ 1 Crash state: onigencunicodembccasefold mbccasefold stringcmpic...

OSV-2022-599 Use-of-uninitialized-value in mrb_bint_as_int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49268 Crash type: Use-of-uninitialized-value Crash state: mrbbintasint mrbensureinttype mrbgetargs...

OSV-2022-375 Stack-use-after-return in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46986 Crash type: Stack-use-after-return READ 1 Crash state: std::1::function::funcbool grk::WaveletReverse::decompresspartialtilei tf::Executor::invoke tf::Executor::spawn...

OSV-2022-327 Stack-use-after-return in QSemaphore::release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525 The issue already existed before oss-fuzz could reproduce it. oss-fuzz found it after qdrawhelper routines were made multithreaded. There might be ways to trigger the issue before that. Crash type: Stack-use-after-return...

OSV-2021-1710 Heap-buffer-overflow in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42472 Crash type: Heap-buffer-overflow WRITE Crash state: ndlz4decompress ndlzdecompress bloscd...

OSV-2021-1509 Heap-buffer-overflow in handle_gets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40455 Crash type: Heap-buffer-overflow READ Crash state: handlegets climbox cliscanmail...

OSV-2021-1414 Heap-buffer-overflow in internal_huf_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39601 Crash type: Heap-buffer-overflow READ 1 Crash state: internalhufdecompress internalexrundopiz defaultdecompresschunk...

OSV-2021-1157 Heap-use-after-free in TranslateRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37410 Crash type: Heap-use-after-free READ 1 Crash state: TranslateRules TranslateWord3 TranslateWord...

OSV-2021-991 Dynamic-stack-buffer-overflow in fmt::v8::detail::dragonbox::umul192_upper64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36110 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: fmt::v8::detail::dragonbox::umul192upper64 fmt::v8::detail::dragonbox::cacheaccessor::computemul fmt::v8::detail::dragonbox::decimalfp...

OSV-2021-927 Heap-buffer-overflow in dhcp_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35870 Crash type: Heap-buffer-overflow WRITE Crash state: dhcpreply dhcppacket FuzzDhcp...

OSV-2021-921 Stack-buffer-overflow in bool re2::DFA::InlinedSearchLoop<true, true, true>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35821 Crash type: Stack-buffer-overflow READ 1 Crash state: bool re2::DFA::InlinedSearchLoop re2::DFA::Search re2::Prog::SearchDFA...

OSV-2021-803 Heap-buffer-overflow in sampled_data_finish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 Crash type: Heap-buffer-overflow WRITE 16 Crash state: sampleddatafinish sampleddatacontinue interp...

OSV-2021-581 UNKNOWN READ in unsigned short flatbuffers::ReadScalar<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32647 Crash type: UNKNOWN READ Crash state: unsigned short flatbuffers::ReadScalar flatbuffers::Table::GetOptionalFieldOffset flatbuffers::Table::CheckField...

OSV-2017-100 Use-of-uninitialized-value in Archive::ConvertAttributes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4272 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertAttributes CmdExtract::ExtractCurrentFile CmdExtract::ExtractArchive...

OSV-2017-39 Use-of-uninitialized-value in IsRelativeSymlinkSafe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4308 Crash type: Use-of-uninitialized-value Crash state: IsRelativeSymlinkSafe ExtractUnixLink30 ExtractSymlink...

OSV-2018-119 UNKNOWN READ in AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t::transition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11367 Crash type: UNKNOWN READ Crash state: AAT::KerxSubTableFormat1::drivercontextt::transition void AAT::StateTableDriver::EntryDat AAT::KerxSubTableFormat1::apply...

OSV-2020-1809 UNKNOWN WRITE in Imf_2_5::copyIntoFrameBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25770 Crash type: UNKNOWN WRITE Crash state: Imf25::copyIntoFrameBuffer Imf25::LineBufferTask::execute IlmThread25::NullThreadPoolProvider::addTask...

OSV-2020-1671 Heap-buffer-overflow in Dasher::Dasher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25243 Crash type: Heap-buffer-overflow READ 4 Crash state: Dasher::Dasher bool drawLineAA& QCosmeticStroker::drawPath...

OSV-2020-1100 Heap-buffer-overflow in tlb_set_page_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15030 Crash type: Heap-buffer-overflow READ 8 Crash state: tlbsetpagemips mipscpuhandlemmufaultmips tlbfillmips...

OSV-2020-1069 Use-of-uninitialized-value in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13289 Crash type: Use-of-uninitialized-value Crash state: inflate ZIPDecode TIFFReadEncodedTileAndAllocBuffer...

OSV-2020-1058 Heap-buffer-overflow in arrow::UnionType::UnionType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20116 Crash type: Heap-buffer-overflow WRITE 4 Crash state: arrow::UnionType::UnionType arrow::union arrow::ipc::internal::ConcreteTypeFromFlatbuffer...

OSV-2020-955 UNKNOWN WRITE in vcf_parse_format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097 Crash type: UNKNOWN WRITE Crash state: vcfparseformat vcfparse vcfread...

OSV-2020-772 Heap-buffer-overflow in __libcpp_strstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23601 Crash type: Heap-buffer-overflow READ 4 Crash state: libcppstrstr strstr pcpp::SipRequestFirstLine::parseVersion...

OSV-2026-824 Stack-buffer-overflow in coolkey_rsa_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=517058311 Crash type: Stack-buffer-overflow READ Crash state: coolkeyrsaop coolkeycomputecrypt sccomputesignature...

OSV-2026-767 Heap-use-after-free in gf_sg_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513912488 Crash type: Heap-use-after-free READ 8 Crash state: gfsgreset gfsgdel fuzzscene.c...

OSV-2026-717 Stack-use-after-scope in enter_block_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511831392 Crash type: Stack-use-after-scope READ 4 Crash state: enterblockcallback mdprocessallblocks mdparse...

OSV-2025-1020 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471093652 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatset ljvmetatsetv...

OSV-2025-239 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=406331578 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/java.lang.StringLatin1.regionMatchesCI java.base/java.lang.String.regionMatches...

OSV-2024-217 Heap-use-after-free in dropNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67670 Crash type: Heap-use-after-free READ 8 Crash state: dropNode api.c xmlFreeNodeList...

OSV-2024-6 Global-buffer-overflow in void jxl::N_AVX2::WriteToOutputStage::StoreUnsignedRow<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65533 Crash type: Global-buffer-overflow READ 16 Crash state: void jxl::NAVX2::WriteToOutputStage::StoreUnsignedRow jxl::NAVX2::WriteToOutputStage::OutputBuffers jxl::NAVX2::WriteToOutputStage::ProcessRow...

OSV-2023-1201 Negative-size-param in pcpp::RawPacket::insertData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64418 Crash type: Negative-size-param Crash state: pcpp::RawPacket::insertData pcpp::Packet::extendLayer pcpp::BgpUpdateMessageLayer::setNetworkLayerReachabilityInfo...

OSV-2023-797 Stack-buffer-overflow in QBuffer::readData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62075 Crash type: Stack-buffer-overflow WRITE Crash state: QBuffer::readData QIODevicePrivate::read QDataStream::readRawData...

OSV-2023-276 Heap-use-after-free in aiScene::~aiScene

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57656 Crash type: Heap-use-after-free READ 8 Crash state: aiScene::aiScene Assimp::BatchLoader::BatchLoader Assimp::LWSImporter::InternReadFile...

OSV-2023-206 Global-buffer-overflow in xmlParseContentInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57225 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseContentInternal xmlParseExternalEntityPrivate xmlParseReference...

OSV-2022-1104 Stack-buffer-overflow in LibRaw::xtrans_interpolate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52775 Crash type: Stack-buffer-overflow WRITE 4 Crash state: LibRaw::xtransinterpolate LibRaw::dcrawprocess RAWHandler::read...

OSV-2022-955 Use-of-uninitialized-value in FileWrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51808 Crash type: Use-of-uninitialized-value Crash state: FileWrite cmsWriteUInt16Number TypeMLUWrite...

OSV-2022-916 Container-overflow in wabt::interp::BinaryReaderInterp::BeginFunctionBody

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51565 Crash type: Container-overflow WRITE 4 Crash state: wabt::interp::BinaryReaderInterp::BeginFunctionBody wabt::ReadBinary wabt::interp::ReadBinaryInterp...

OSV-2022-714 Heap-buffer-overflow in dynapi_set_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194 Crash type: Heap-buffer-overflow WRITE 16 Crash state: dynapisethelper dwgdynapiheadersetvalue jsonHEADER...

OSV-2022-601 Heap-buffer-overflow in mrb_bint_xor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49255 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbbintxor intxor mrbvmexec...

OSV-2022-458 Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47797 Crash type: Uncaught exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.util.HashMap.get com.ctc.wstx.dtd.FullDTDReader.findSharedName...

OSV-2021-1760 Heap-buffer-overflow in grk::GrkImage::sycc420_to_rgb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42931 Crash type: Heap-buffer-overflow WRITE 4 Crash state: grk::GrkImage::sycc420torgb grk::GrkImage::colorsycctorgb grk::GrkImage::colorConvert...