OSV-2020-243 Heap-buffer-overflow in OT::VarRegionList::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19956 Crash type: Heap-buffer-overflow READ 12 Crash state: OT::VarRegionList::serialize OT::VariationStore::serialize bool OT::HVARVVAR::subset...

OSV-2020-213 Heap-buffer-overflow in Op_YCbCr422_to_RGB_16bit::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21114 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCr422toRGB16bit::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-187 UNKNOWN READ in arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21680 Crash type: UNKNOWN READ Crash state: arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32 arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeInitialBuffer...

OSV-2020-130 Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20919 Crash type: Use-of-uninitialized-value Crash state: OT::TupleVarHeader::calculatescalar OT::gvar::acceleratort::applydeltastopoints bool OT::glyf::Glyph::getpointsbool OT::glyf::acceleratort::getpointsOT::gl...

OSV-2020-95 Use-of-uninitialized-value in jbig2_arith_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20493 Crash type: Use-of-uninitialized-value Crash state: jbig2arithdecode jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-86 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20735 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts parquet::DictByteArrayDecoderImpl::DecodeArrowDense parquet::DictByteArrayDecoderImpl::DecodeArrow...

OSV-2020-42 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20695 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-53 Index-out-of-bounds in parse_exp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22925 Crash type: Index-out-of-bounds Crash state: parseexp parsebranch parsealts...

OSV-2020-19 Heap-use-after-free in htp_connp_is_line_terminator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21712 Crash type: Heap-use-after-free READ 1 Crash state: htpconnpislineterminator htpconnpREQHEADERS htpconnpreqdata...

OSV-2020-1 Use-of-uninitialized-value in numaCrossingsByThreshold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22764 Crash type: Use-of-uninitialized-value Crash state: numaCrossingsByThreshold numaSelectCrossingThreshold pixExtractBarcodeCrossings...

OSV-2026-1293 UNKNOWN READ in md_is_link_title

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=561822522 Crash type: UNKNOWN READ Crash state: mdislinktitle mdanalyzeinlines mdprocessnormalblockcontents...

OSV-2026-1064 Heap-buffer-overflow in _wcsnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533963816 Crash type: Heap-buffer-overflow READ 2 Crash state: wcsnlen railreadunicodestring railreadhighcontrast...

OSV-2026-925 Heap-buffer-overflow in ssh_config_parse_line_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523820519 Crash type: Heap-buffer-overflow READ 1 Crash state: sshconfigparselineinternal sshconfigparsestring sshclientconfigfuzzer.c...

OSV-2026-837 Heap-use-after-free in grk::TileProcessor::parseTilePart

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519348401 Crash type: Heap-use-after-free READ 8 Crash state: grk::TileProcessor::parseTilePart tf::Executor::invoke tf::Executor::spawn...

OSV-2026-741 Heap-buffer-overflow in p11_lexer_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513100838 Crash type: Heap-buffer-overflow READ 2 Crash state: p11lexernext conffuzzer.c...

OSV-2026-716 Heap-buffer-overflow in H5VM_memcpyvv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511687450 Crash type: Heap-buffer-overflow READ 4 Crash state: H5VMmemcpyvv H5Dcompactreadvv H5Dselectio...

OSV-2026-666 Heap-use-after-free in insertkey

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=508107730 Crash type: Heap-use-after-free READ 1 Crash state: insertkey luaHresize luaHnewkey...

OSV-2026-616 Use-of-uninitialized-value in JXRHandlerPrivate::colorSpace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505263965 Crash type: Use-of-uninitialized-value Crash state: JXRHandlerPrivate::colorSpace JXRHandlerPrivate::imageFormat JXRHandler::read...

OSV-2026-539 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499813979 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...

OSV-2026-514 Heap-buffer-overflow in format_expand1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498472071 Crash type: Heap-buffer-overflow READ 1 Crash state: formatexpand1 formatexpand format-fuzzer.c...

OSV-2026-484 Heap-buffer-overflow in DecodeBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=496959764 Crash type: Heap-buffer-overflow READ 1 Crash state: DecodeBlock testdecoderprocess EsOutSend...

OSV-2026-302 Use-of-uninitialized-value in BIO_new_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486713209 Crash type: Use-of-uninitialized-value Crash state: BIOnewfile libcrypto.so.3 CONFmodulesloadfileex...

OSV-2026-244 Use-of-uninitialized-value in ihevcd_fmt_conv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=484466027 Crash type: Use-of-uninitialized-value Crash state: ihevcdfmtconv ihevcdprocessthread...

OSV-2025-819 Use-of-uninitialized-value in HasAlpha32b_SSE2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=449546226 Crash type: Use-of-uninitialized-value Crash state: HasAlpha32bSSE2 WebPPictureHasTransparency VP8LEncodeImage...

OSV-2025-764 Global-buffer-overflow in Ogg_CreateES

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=445845228 Crash type: Global-buffer-overflow READ 11 Crash state: OggCreateES Demux demuxprocessstream...

OSV-2025-618 Heap-buffer-overflow in iTUNTripletCallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437731214 Crash type: Heap-buffer-overflow READ 3 Crash state: iTUNTripletCallback SetupMeta MP4LoadMeta...

OSV-2025-616 Heap-buffer-overflow in Open

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437593508 Crash type: Heap-buffer-overflow READ 7 Crash state: Open demuxProbe vlcmoduleload...

OSV-2025-600 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=436037111 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack Imf34::ScanLineInputFile::Data::readPixels Imf34::InputFile::readPixels...

OSV-2025-597 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435779241 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack exrdecodingrun Imf34::ScanLineProcess::rundecode...

OSV-2025-591 UNKNOWN READ in mov_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435536867 Crash type: UNKNOWN READ Crash state: movreadheader avformatopeninput demuxopenlavf...

OSV-2025-580 UNKNOWN READ in signed char Assimp::StreamReader<false, false>::Get<signed char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434414094 Crash type: UNKNOWN READ Crash state: signed char Assimp::StreamReader::Get Assimp::COBImporter::ReadBinaryFile Assimp::COBImporter::InternReadFile...

OSV-2025-542 Use-of-uninitialized-value in httpEncode64_3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110066 Crash type: Use-of-uninitialized-value Crash state: httpEncode643 fuzzhttpcore.c fuzzhttpcore.c...

OSV-2025-515 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754593 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-486 Bad-cast to cv::PngDecoder from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=426783958 Crash type: Bad-cast Crash state: Bad-cast to cv::PngDecoder from invalid vptr cv::PngDecoder::readData cv::imdecode...

OSV-2025-412 UNKNOWN WRITE in luaL_newstate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420248727 Crash type: UNKNOWN WRITE Crash state: luaLnewstate...

OSV-2025-401 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=419340194 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.nio.CharBuffer.wrap java.base/sun.nio.cs.StreamEncoder.implWrite...

OSV-2025-374 Use-of-uninitialized-value in pcpp::SomeIpSdEntry::SomeIpSdEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=418036603 Crash type: Use-of-uninitialized-value Crash state: pcpp::SomeIpSdEntry::SomeIpSdEntry pcpp::SomeIpSdLayer::getEntries readParsedPacket...

OSV-2025-371 Index-out-of-bounds in tcp_analyze_sequence_number

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=417518224 Crash type: Index-out-of-bounds Crash state: tcpanalyzesequencenumber dissecttcp calldissectorthroughhandle...

OSV-2025-369 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=417515043 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop java.base/sun.nio.cs.UTF8$Encoder.encodeLoop...

OSV-2025-363 Heap-buffer-overflow in jv_string_vfmt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=417323384 Crash type: Heap-buffer-overflow READ 2 Crash state: jvstringvfmt jvstringfmt jvget...

OSV-2025-280 Heap-buffer-overflow in Assimp::SceneCombiner::CopyScene

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=410393968 Crash type: Heap-buffer-overflow READ Crash state: Assimp::SceneCombiner::CopyScene Assimp::Exporter::Export Assimp::Exporter::ExportToBlob...

OSV-2025-207 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=403330010 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...

OSV-2025-175 UNKNOWN READ in insert_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=399390672 Crash type: UNKNOWN READ Crash state: insertfree chunkobjalloc pdfiobjectalloc...

OSV-2025-108 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=395207096 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

OSV-2024-1423 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391709145 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange org.apache.poi.util.IOUtils.safelyClone org.apache.poi.ddf.EscherMetafileBlip.fillFields...

OSV-2024-1355 UNKNOWN READ in glslang::TInfoSinkBase::location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382922237 Crash type: UNKNOWN READ Crash state: glslang::TInfoSinkBase::location glslang::TParseContextBase::outputMessage glslang::TParseContextBase::error...

OSV-2024-1312 Heap-buffer-overflow in jv_string_vfmt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=378836890 Crash type: Heap-buffer-overflow READ 13 Crash state: jvstringvfmt jvstringfmt jvparsesizedcustomflags...

OSV-2024-1310 Use-of-uninitialized-value in decompress_yuv.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=378750938 Crash type: Use-of-uninitialized-value Crash state: decompressyuv.cc...

OSV-2024-1209 Heap-use-after-free in xmlValidateOneElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372547409 Crash type: Heap-use-after-free READ 4 Crash state: xmlValidateOneElement xmlValidateElement api.c...

OSV-2024-1182 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371233025 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec com.ctc.wstx.dtd.FullDTDReader.skipDtdWs com.ctc.wstx.dtd.FullDTDReader.readContentSpec...