OSV-2020-756 Use-of-uninitialized-value in spng_read_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23936 Crash type: Use-of-uninitialized-value Crash state: spngreadfuzzer.c spngreadfuzzer.c...

OSV-2020-718 UNKNOWN READ in double_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18153 Crash type: UNKNOWN READ Crash state: doublefromwkbstate ptarrayfromwkbstate lwlinefromwkbstate...

OSV-2020-677 Heap-buffer-overflow in load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15007 Crash type: Heap-buffer-overflow READ 4 Crash state: load rbinobjectnew rbinfilenewfrombuffer...

OSV-2020-658 Heap-buffer-overflow in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15495 Crash type: Heap-buffer-overflow READ 1 Crash state: inflate perfetto::traceprocessor::GzipTraceParser::Parse perfetto::traceprocessor::TraceProcessorImpl::Parse...

OSV-2020-515 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18320 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== cryptofuzz::ExecutorBase::compa...

OSV-2020-474 Bad-free in spss_varinfo_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12595 Crash type: Bad-free Crash state: spssvarinfofree savreadvariablerecord savparserecordspass2...

OSV-2020-417 Heap-buffer-overflow in idn2_to_ascii_4i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 Crash type: Heap-buffer-overflow WRITE Crash state: idn2toascii4i libidn2toascii8zfuzzer.c...

OSV-2020-379 Heap-buffer-overflow in UA_unbase64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14621 Crash type: Heap-buffer-overflow WRITE 1 Crash state: UAunbase64 ByteStringdecodeJson decodeFields...

OSV-2020-335 Global-buffer-overflow in template_fuzzer.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18988 Crash type: Global-buffer-overflow WRITE 1 Crash state: templatefuzzer.cc...

OSV-2020-288 Heap-use-after-free in pixReadMemBmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19723 Crash type: Heap-use-after-free READ Crash state: pixReadMemBmp pixReadMem pixrotateshearfuzzer.cc...

OSV-2020-286 Use-of-uninitialized-value in ZSTD_loadCEntropy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19146 Crash type: Use-of-uninitialized-value Crash state: ZSTDloadCEntropy ZSTDloadZstdDictionary ZSTDcompressinsertDictionary...

OSV-2020-218 Heap-buffer-overflow in __libcpp_strstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23145 Crash type: Heap-buffer-overflow READ 13 Crash state: libcppstrstr strstr pcpp::SipRequestFirstLine::parseVersion...

OSV-2020-156 Heap-buffer-overflow in flb_unescape_string_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22132 Crash type: Heap-buffer-overflow READ 1 Crash state: flbunescapestringutf8 logfmtparser flbparserlogfmtdo...

OSV-2020-143 Heap-buffer-overflow in QSpecialInteger<QBigEndianStorageType<unsigned int> >::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21909 Crash type: Heap-buffer-overflow READ 4 Crash state: QSpecialInteger ::operator unsigned int QIcc::fromIccProfile QColorSpace::fromIccProfile...

OSV-2020-137 UNKNOWN READ in dav1d_resize_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21547 Crash type: UNKNOWN READ Crash state: dav1dresizessse3...

OSV-2020-76 Heap-use-after-free in pixAverageRasterScans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22760 Crash type: Heap-use-after-free READ 1 Crash state: pixAverageRasterScans pixExtractBarcodeCrossings pixExtractBarcodeWidths1...

OSV-2020-71 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22167 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpiparsepacketlineinfo ndpichecksteamhttp ndpisearchsteam...

OSV-2020-58 Heap-buffer-overflow in asn1_get_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20373 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1getnext x509parseextcertificatepolicies x509parseextensiondata...

OSV-2020-73 UNKNOWN WRITE in vips_foreign_load_gif_render

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20613 Crash type: UNKNOWN WRITE Crash state: vipsforeignloadgifrender vipsforeignloadgifnextpage vipsforeignloadgifgenerate...

OSV-2020-75 Index-out-of-bounds in der_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20753 Crash type: Index-out-of-bounds Crash state: dertag dercmp magiccheck...

OSV-2020-39 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22899 Crash type: Heap-use-after-free READ 1 Crash state: ndpihttpcheckcontent ndpiinthttpaddconnection ndpicheckhttptcp...

OSV-2020-11 Heap-buffer-overflow in jbig2_image_get_pixel_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20440 Crash type: Heap-buffer-overflow READ 1 Crash state: jbig2imagegetpixelfast jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-10 Heap-use-after-free in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20164 Crash type: Heap-use-after-free READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c noderelease...

OSV-2020-5 Heap-buffer-overflow in virtual thunk to parquet::ByteStreamSplitDecoder<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21453 Crash type: Heap-buffer-overflow READ 1 Crash state: virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalT...

OSV-2026-1293 UNKNOWN READ in md_is_link_title

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=561822522 Crash type: UNKNOWN READ Crash state: mdislinktitle mdanalyzeinlines mdprocessnormalblockcontents...

OSV-2026-1239 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=557292360 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-1125 Segv on unknown address in match_many_CHARACTER_REV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=543352138 Crash type: Segv on unknown address Crash state: matchmanyCHARACTERREV countone basicmatch...

OSV-2026-1064 Heap-buffer-overflow in _wcsnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533963816 Crash type: Heap-buffer-overflow READ 2 Crash state: wcsnlen railreadunicodestring railreadhighcontrast...

OSV-2026-958 Use-of-uninitialized-value in LibRaw::fbdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526284076 Crash type: Use-of-uninitialized-value Crash state: LibRaw::fbdd LibRaw::dcrawprocess librawfuzzer.cc...

OSV-2026-867 Bad-cast to std::__shared_weak_count from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520147546 Crash type: Bad-cast Crash state: Bad-cast to std::sharedweakcount from invalid vptr std::1::sharedptr::sharedptr Assimp::STEP::ReadFileHeader...

OSV-2026-721 Heap-buffer-overflow in H5D__scatter_mem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512001847 Crash type: Heap-buffer-overflow WRITE Crash state: H5Dscattermem H5Dscatgathread H5Dcontigread...

OSV-2026-713 Use-of-uninitialized-value in ojph::local::tile::pull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511443006 Crash type: Use-of-uninitialized-value Crash state: ojph::local::tile::pull ojph::local::codestream::pull ojphexpandfuzztarget.cpp...

OSV-2026-568 Heap-buffer-overflow in ultrahdr::IccHelper::readIccColorGamut

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=501676165 Crash type: Heap-buffer-overflow READ 1 Crash state: ultrahdr::IccHelper::readIccColorGamut ultrahdr::JpegR::decodeJPEGR uhdrdecode...

OSV-2026-212 UNKNOWN READ in gpsd_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482617785 Crash type: UNKNOWN READ Crash state: gpsdpoll FuzzDriversStructured.c...

OSV-2026-205 UNKNOWN READ in gpsd_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=481932457 Crash type: UNKNOWN READ Crash state: gpsdpoll FuzzDrivers.c...

OSV-2026-167 Use-of-uninitialized-value in aivdm_analyze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479564939 Crash type: Use-of-uninitialized-value Crash state: aivdmanalyze gpsdpoll FuzzDrivers.c...

OSV-2026-136 Memcpy-param-overlap in grk::memStreamRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=478035120 Crash type: Memcpy-param-overlap Crash state: grk::memStreamRead grk::BufferedStream::read grk::MarkerParser::readSOTorEOC...

OSV-2026-86 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431399 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange org.apache.poi.util.IOUtils.safelyClone org.apache.poi.ddf.EscherBlipRecord.setPictureData...

OSV-2026-53 Heap-use-after-free in graph::LigatureSubstFormat1::shrink

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475607265 Crash type: Heap-use-after-free READ 8 Crash state: graph::LigatureSubstFormat1::shrink graph::LigatureSubstFormat1::splitcontextt::shrink hbvectort graph::actuatesubtablesplitgraph::LigatureSu...

OSV-2025-955 Use-of-uninitialized-value in decoder_context::construct_reference_picture_lists

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=464323256 Crash type: Use-of-uninitialized-value Crash state: decodercontext::constructreferencepicturelists decodercontext::processslicesegmentheader decodercontext::readsliceNAL...

OSV-2025-830 Security exception in java.base/java.lang.AbstractStringBuilder.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=451017447 Crash type: Security exception Crash state: java.base/java.lang.AbstractStringBuilder. java.base/java.lang.StringBuilder. com.ctc.wstx.util.TextBuffer.contentsAsString...

OSV-2025-796 Heap-buffer-overflow in AddGreenToBlueAndRed_AVX2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447958064 Crash type: Heap-buffer-overflow WRITE Crash state: AddGreenToBlueAndRedAVX2 VP8LInverseTransform ProcessRows...

OSV-2025-677 Heap-buffer-overflow in TGAHandler::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=440374852 Crash type: Heap-buffer-overflow WRITE 4 Crash state: TGAHandler::read kimgiofuzzer.cc LLVMFuzzerRunDriver...

OSV-2025-620 Heap-buffer-overflow in FragPrepareChunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437694938 Crash type: Heap-buffer-overflow WRITE 8 Crash state: FragPrepareChunk DemuxFrag demuxprocessstream...

OSV-2025-593 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435479026 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatget ljvmetatgetv...

OSV-2025-570 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=433311401 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.io.BufferedWriter.write java.base/java.io.Writer.write...

OSV-2025-541 Heap-buffer-overflow in js_create_function

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091578 Crash type: Heap-buffer-overflow READ 2 Crash state: jscreatefunction JSEvalInternal JSEvalObject...

OSV-2025-524 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429330008 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal asyncfuncresume jsasyncfunctionresume...

OSV-2025-484 Heap-buffer-overflow in load_protocols_file_fd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=426164365 Crash type: Heap-buffer-overflow READ 2 Crash state: loadprotocolsfilefd fuzzfilecfgprotocols.c...

OSV-2025-481 Stack-buffer-overflow in void glz::from<10000u, int>::op<glz::opts_csv{10000u,

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=425730091 Crash type: Stack-buffer-overflow READ 1 Crash state: void glz::from::op::op::opglz::optscsv10000u,...