OSV-2026-1089 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537432125 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

OSV-2026-1084 UNKNOWN READ in bytes1_char_at

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536956124 Crash type: UNKNOWN READ Crash state: bytes1charat basicmatch dobestfuzzymatch...

OSV-2026-1083 Heap-buffer-overflow in parseGoosePayload

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539005080 Crash type: Heap-buffer-overflow READ 1 Crash state: parseGoosePayload parseGooseMessage fuzzgoosesubscriber.c...

OSV-2026-1077 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536937906 Crash type: Heap-buffer-overflow READ Crash state: std::1::basicstring, std::1::allocatorch Assimp::XFileParser::GetNextToken Assimp::XFileParser::ParseDataObjectTemplate...

OSV-2026-1072 UNKNOWN READ in _regex.cpython-311-x86_64-linux-gnu.so

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539159630 Crash type: UNKNOWN READ Crash state: regex.cpython-311-x8664-linux-gnu.so regex.cpython-311-x8664-linux-gnu.so regex.cpython-311-x8664-linux-gnu.so...

OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...

OSV-2026-1070 UNKNOWN READ in bytes1_char_at

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=538179114 Crash type: UNKNOWN READ Crash state: bytes1charat unicodewordleft unicodeatboundary...

OSV-2026-1069 Segv on unknown address in glslang::TPpContext::tokenPaste

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539180630 Crash type: Segv on unknown address Crash state: glslang::TPpContext::tokenPaste glslang::TPpContext::tokenize glslang::TShader::preprocess...

OSV-2026-1068 UNKNOWN READ in jpeg_abort

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537793912 Crash type: UNKNOWN READ Crash state: jpegabort tj3Compress8 compress.cc...

OSV-2026-1064 Heap-buffer-overflow in _wcsnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533963816 Crash type: Heap-buffer-overflow READ 2 Crash state: wcsnlen railreadunicodestring railreadhighcontrast...

OSV-2026-1060 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533737064 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-1054 Heap-buffer-overflow in ihevcd_cabac_decode_bins_tunary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533053032 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdcabacdecodebinstunary ihevcdparsetransformtree ihevcdparsetransformtree...

OSV-2026-1052 UNKNOWN READ in eprosima::fastdds::dds::QosPoliciesSerializer<eprosima::fastdds::dds::PartitionQ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=532839120 Crash type: UNKNOWN READ Crash state: eprosima::fastdds::dds::QosPoliciesSerializereprosima::fastdds::dds::PartitionQ eprosima::fastdds::rtps::ReaderProxyData::readfromcdrmessage fuzzproxycdr.cxx...

OSV-2026-1049 Heap-buffer-overflow in Assimp::X3DExporter::CheckAndExport_Light

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=532625491 Crash type: Heap-buffer-overflow READ 8 Crash state: Assimp::X3DExporter::CheckAndExportLight Assimp::X3DExporter::ExportNode Assimp::X3DExporter::X3DExporter...

OSV-2026-1043 Index-out-of-bounds in impd_drc_gen_instructions_derived_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531676895 Crash type: Index-out-of-bounds Crash state: impddrcgeninstructionsderiveddata impdparsedrcconfig impddrcinit...

OSV-2026-1041 Heap-buffer-overflow in Assimp::ObjExporter::indexMap<Assimp::ObjExporter::vertexData, Assimp::ObjExport

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531365119 Crash type: Heap-buffer-overflow WRITE 12 Crash state: Assimp::ObjExporter::indexMapAssimp::ObjExporter::vertexData, Assimp::ObjExport Assimp::ObjExporter::WriteGeometryFile Assimp::ObjExporter::ObjExporter...

OSV-2026-1039 Index-out-of-bounds in iusace_estimate_scfs_chan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531479957 Crash type: Index-out-of-bounds Crash state: iusaceestimatescfschan iusacequantizespec iusacefdencode...

OSV-2026-1035 Heap-buffer-overflow in Assimp::D3MF::D3MFExporter::writeFaces

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531123003 Crash type: Heap-buffer-overflow READ 4 Crash state: Assimp::D3MF::D3MFExporter::writeFaces Assimp::D3MF::D3MFExporter::writeMesh Assimp::D3MF::D3MFExporter::writeObjects...

OSV-2026-1033 Heap-buffer-overflow in ppp_tx_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531087610 Crash type: Heap-buffer-overflow READ Crash state: ppptxframe ppprx mgtcpiprx...

OSV-2026-1032 Use-of-uninitialized-value in Assimp::PbrtExporter::WriteTextures

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531040219 Crash type: Use-of-uninitialized-value Crash state: Assimp::PbrtExporter::WriteTextures Assimp::PbrtExporter::WriteWorldDefinition Assimp::PbrtExporter::PbrtExporter...

OSV-2026-1030 Use-of-uninitialized-value in Assimp::glTFExporter::GetTexSampler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=531097475 Crash type: Use-of-uninitialized-value Crash state: Assimp::glTFExporter::GetTexSampler Assimp::glTFExporter::GetMatColorOrTex Assimp::glTFExporter::ExportMaterials...

OSV-2026-1027 Heap-buffer-overflow in mp_load_float

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530970666 Crash type: Heap-buffer-overflow WRITE 4 Crash state: mploadfloat mpdecodefloat luampdecodewithctx...

OSV-2026-1026 Global-buffer-overflow in txt2sd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530698821 Crash type: Global-buffer-overflow READ 1 Crash state: txt2sd fuzzmdnsxht.cc...

OSV-2026-1025 Heap-buffer-overflow in decode_common_resp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530730553 Crash type: Heap-buffer-overflow READ 1 Crash state: decodecommonresp decodegeterrorinjectionmodev1resp decodegeterrorinjectionmodev1respfuzzer.cc...

OSV-2026-1022 Heap-buffer-overflow in decode_common_resp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530698795 Crash type: Heap-buffer-overflow READ 1 Crash state: decodecommonresp decodecommonrespfuzzer.cc...

OSV-2026-1018 Heap-buffer-overflow in decode_reason_code_and_cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530730549 Crash type: Heap-buffer-overflow READ 1 Crash state: decodereasoncodeandcc decodensmprovidetokenresp decodensmprovidetokenrespfuzzer.cc...

OSV-2026-1016 Heap-buffer-overflow in decode_query_device_identification_resp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530569583 Crash type: Heap-buffer-overflow READ 1 Crash state: decodequerydeviceidentificationresp decodequerydeviceidentificationrespfuzzer.cc...

OSV-2026-1015 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530322176 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

OSV-2026-995 Heap-double-free in dxf_entities_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528859714 Crash type: Heap-double-free Crash state: dxfentitiesread dwgreaddxf llvmfuzz.c...

OSV-2026-987 Index-out-of-bounds in print_insn_tic6x

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528509499 Crash type: Index-out-of-bounds Crash state: printinsntic6x disassemblesection bfdmapoversections...

OSV-2026-981 Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527773834 Crash type: Heap-buffer-overflow WRITE 4 Crash state: std::1::function::funcgrk::FileFormatJP2Decompress::FileFormatJP2Decompre std::1::function::funcgrk::CodeStreamDecompress::postMultiTile...

OSV-2026-974 UNKNOWN READ in unsigned long std::__1::__tree<Ogre::VertexDeclaration*, std::__1::less<Ogre::Ve

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528038936 Crash type: UNKNOWN READ Crash state: unsigned long std::1::treeOgre::VertexDeclaration, std::1::lessOgre::Ve Ogre::HardwareBufferManagerBase::destroyVertexDeclaration Ogre::VertexData::VertexData...

OSV-2026-973 Heap-buffer-overflow in bfd_getl16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528056360 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl16 m32relfgenericreloc bfdperformrelocation...

OSV-2026-970 Use-of-uninitialized-value in ogs_cpystrn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527978938 Crash type: Use-of-uninitialized-value Crash state: ogscpystrn ogsnas5gsdecodednn ogsnas5gsdecodepdusessionestablishmentaccept...

OSV-2026-969 Heap-use-after-free in Ogre::VertexData::convertPackedColour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527766102 Crash type: Heap-use-after-free READ 1 Crash state: Ogre::VertexData::convertPackedColour Ogre::MeshSerializerImpl::readGeometry Ogre::MeshSerializerImpl::readMesh...

OSV-2026-963 Bad-cast to Ogre::HardwareBuffer from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526758819 Crash type: Bad-cast Crash state: Bad-cast to Ogre::HardwareBuffer from invalid vptr Ogre::HardwareBuffer::unlockImpl Ogre::HardwareBuffer::unlock...

OSV-2026-962 Use-of-uninitialized-value in iup_delta_optimize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526770452 Crash type: Use-of-uninitialized-value Crash state: iupdeltaoptimize OT::tupledeltat::optimize OT::TupleVariationData::tuplevariations...

OSV-2026-959 Heap-use-after-free in Wt::Http::Request::parseFormUrlEncoded

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526224351 Crash type: Heap-use-after-free READ 8 Crash state: Wt::Http::Request::parseFormUrlEncoded Wt::CgiParser::parse fuzz-cgi.C...

OSV-2026-958 Use-of-uninitialized-value in LibRaw::fbdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526284076 Crash type: Use-of-uninitialized-value Crash state: LibRaw::fbdd LibRaw::dcrawprocess librawfuzzer.cc...

OSV-2026-933 UNKNOWN READ in aiMesh::~aiMesh

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=524387782 Crash type: UNKNOWN READ Crash state: aiMesh::aiMesh Assimp::ASEImporter::InternReadFile Assimp::BaseImporter::ReadFile...

OSV-2026-928 Stack-use-after-scope in StreamReader_CApi::wait_for_file_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=524393006 Crash type: Stack-use-after-scope READ 8 Crash state: StreamReaderCApi::waitforfilesize Boxiloc::readdata HeifFile::appenddatafromiloc...

OSV-2026-925 Heap-buffer-overflow in ssh_config_parse_line_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523820519 Crash type: Heap-buffer-overflow READ 1 Crash state: sshconfigparselineinternal sshconfigparsestring sshclientconfigfuzzer.c...

OSV-2026-923 Heap-use-after-free in gf_node_unregister

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523799837 Crash type: Heap-use-after-free READ 8 Crash state: gfnodeunregister BMParseCommand gfbifsflushcommandlist...

OSV-2026-917 Heap-buffer-overflow in ixheaace_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523531852 Crash type: Heap-buffer-overflow WRITE Crash state: ixheaaceprocess xaacencfuzzer.cpp...

OSV-2026-910 Heap-use-after-free in gf_node_unregister

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523017646 Crash type: Heap-use-after-free READ 8 Crash state: gfnodeunregister BDDecSceneReplace BMSceneReplace...

OSV-2026-907 Heap-use-after-free in gf_sg_route_del

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=523017644 Crash type: Heap-use-after-free READ 8 Crash state: gfsgroutedel gfsgreset gfsgdel...

OSV-2026-903 UNKNOWN in avi_parse_input_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=522061221 Crash type: UNKNOWN Crash state: aviparseinputfile AVIopeninputfile avidmxprocess...

OSV-2026-896 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=521163865 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-895 Heap-buffer-overflow in ihevcd_fmt_conv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=521437880 Crash type: Heap-buffer-overflow WRITE 8 Crash state: ihevcdfmtconv ihevcdprocessthread startthread...

OSV-2026-892 Heap-buffer-overflow in decode_R13_RNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=521044421 Crash type: Heap-buffer-overflow READ 8 Crash state: decodeR13RNUMBER dwgdecode llvmfuzz.c...