OSV-2026-551 UNKNOWN WRITE in ___interceptor_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=500762221 Crash type: UNKNOWN WRITE Crash state: interceptorfree ppdClose fuzzppdgen1.c...

OSV-2026-548 UNKNOWN in ojph::local::precinct::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=500177411 Crash type: UNKNOWN Crash state: ojph::local::precinct::parse ojph::local::resolution::parseoneprecinct ojph::local::tile::parsetileheader...

OSV-2026-539 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499813979 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...

OSV-2026-535 Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499447433 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2026-534 Heap-buffer-overflow in cram_encode_container

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499447432 Crash type: Heap-buffer-overflow READ 1 Crash state: cramencodecontainer cramflushcontainermt cramclose...

OSV-2026-532 Heap-buffer-overflow in regsub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499446092 Crash type: Heap-buffer-overflow READ 1 Crash state: regsub formatreplace formatexpand1...

OSV-2026-524 Security exception in org.apache.poi.ss.formula.OperandClassTransformer.transformNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499126302 Crash type: Security exception Crash state: org.apache.poi.ss.formula.OperandClassTransformer.transformNode org.apache.poi.ss.formula.OperandClassTransformer.isSimpleValueFunction...

OSV-2026-521 UNKNOWN READ in unsigned long Assimp::StreamReader<true, true>::Get<unsigned long>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499121788 Crash type: UNKNOWN READ Crash state: unsigned long Assimp::StreamReader::Get bool Assimp::Blender::Structure::ResolvePointerstd::1::sharedptr, Assimp::Bl bool Assimp::Blender::Structure::ReadFieldPtr2,...

OSV-2026-518 Use-of-uninitialized-value in ne_read_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498498500 Crash type: Use-of-uninitialized-value Crash state: nereadblock nesteggreadpacket fuzz.cc...

OSV-2026-514 Heap-buffer-overflow in format_expand1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498472071 Crash type: Heap-buffer-overflow READ 1 Crash state: formatexpand1 formatexpand format-fuzzer.c...

OSV-2026-512 Heap-buffer-overflow in g_utf8_get_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498475244 Crash type: Heap-buffer-overflow READ 1 Crash state: gutf8getchar gmarkupescapetext fuzzmarkupescapetext.c...

OSV-2026-507 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498705946 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-505 UNKNOWN READ in unsigned int Assimp::StreamReader<true, true>::Get<unsigned int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498284131 Crash type: UNKNOWN READ Crash state: unsigned int Assimp::StreamReader::Get void Assimp::Blender::ConvertDispatcher void Assimp::Blender::Structure::ReadField...

OSV-2026-504 Heap-use-after-free in ObjectStream::getObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498251261 Crash type: Heap-use-after-free READ 4 Crash state: ObjectStream::getObject XRef::fetch XRef::fetch...

OSV-2026-484 Heap-buffer-overflow in DecodeBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=496959764 Crash type: Heap-buffer-overflow READ 1 Crash state: DecodeBlock testdecoderprocess EsOutSend...

OSV-2026-481 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=496552925 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

OSV-2026-461 UNKNOWN READ in XRef::constructObjectEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=495914144 Crash type: UNKNOWN READ Crash state: XRef::constructObjectEntry XRef::constructXRef XRef::XRef...

OSV-2026-455 UNKNOWN READ in mkv::matroska_segment_c::TrackInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=495498906 Crash type: UNKNOWN READ Crash state: mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::ParseTrackEntry...

OSV-2026-449 Use-of-uninitialized-value in pcpp::SomeIpSdEntry::SomeIpSdEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=495096701 Crash type: Use-of-uninitialized-value Crash state: pcpp::SomeIpSdEntry::SomeIpSdEntry pcpp::SomeIpSdLayer::getEntries readParsedPacket...

OSV-2026-437 Heap-use-after-free in tf::Executor::_invoke

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=494709474 Crash type: Heap-use-after-free WRITE 8 Crash state: tf::Executor::invoke tf::Executor::spawn void std::1::threadproxy...

OSV-2026-431 Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=494047119 Crash type: Use-of-uninitialized-value Crash state: pcpp::IDnsResource::decodeName pcpp::IDnsResource::IDnsResource pcpp::DnsLayer::parseResources...

OSV-2026-417 Segv on unknown address in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=493063924 Crash type: Segv on unknown address Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::ArrayPrinter::Print...

OSV-2026-392 UNKNOWN READ in pcpp::BgpLayer::getHeaderLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=491687588 Crash type: UNKNOWN READ Crash state: pcpp::BgpLayer::getHeaderLen pcpp::Packet::shortenLayer pcpp::Layer::shortenLayer...

OSV-2026-387 Security exception in org.apache.poi.ss.formula.FormulaParser.parseSheetRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=491506839 Crash type: Security exception Crash state: org.apache.poi.ss.formula.FormulaParser.parseSheetRange org.apache.poi.ss.formula.FormulaParser.parseSheetName java.base/java.lang.AbstractStringBuilder.append...

OSV-2026-386 Use-of-uninitialized-value in pcpp::byteArrayToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=491288647 Crash type: Use-of-uninitialized-value Crash state: pcpp::byteArrayToHexString pcpp::PacketTrailerLayer::toString FuzzTarget.cpp...

OSV-2026-384 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=491529466 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.nio.CharBuffer.wrap java.base/sun.nio.cs.StreamEncoder.implWrite...

OSV-2026-374 Security exception in org.apache.poi.ss.formula.FormulaParser.additiveExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=490896964 Crash type: Security exception Crash state: org.apache.poi.ss.formula.FormulaParser.additiveExpression org.apache.poi.ss.formula.FormulaParser.concatExpression...

OSV-2026-371 Heap-buffer-overflow in tinyobj::tryParseDouble

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=490598877 Crash type: Heap-buffer-overflow READ 1 Crash state: tinyobj::tryParseDouble tinyobj::LoadObjInternal tinyobj::LoadObj...

OSV-2026-370 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=490658507 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.System$2.encodeASCII java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop...

OSV-2026-359 Segv on unknown address in gpsd_vlog

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=490142464 Crash type: Segv on unknown address Crash state: gpsdvlog gpsdlog processGSV...

OSV-2026-357 Heap-buffer-overflow in _cupsRasterAddError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489911024 Crash type: Heap-buffer-overflow WRITE 3 Crash state: cupsRasterAddError cupsRasterExecPS fuzzcups.c...

OSV-2026-356 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489370855 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-354 Use-of-uninitialized-value in pcpp::MplsLayer::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489360236 Crash type: Use-of-uninitialized-value Crash state: pcpp::MplsLayer::toString FuzzTarget.cpp pcpp::RawPacket::RawPacket...

OSV-2026-350 UNKNOWN READ in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489127262 Crash type: UNKNOWN READ Crash state: bfdgetl32 mips3264bitreloc bfdperformrelocation...

OSV-2026-344 UNKNOWN READ in void Assimp::Blender::ConvertDispatcher<float>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488752792 Crash type: UNKNOWN READ Crash state: void Assimp::Blender::ConvertDispatcher void Assimp::Blender::Structure::ReadFieldArray void Assimp::Blender::Structure::Convert...

OSV-2026-343 Heap-buffer-overflow in pcre2_compile_32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488713937 Crash type: Heap-buffer-overflow WRITE 4 Crash state: pcre2compile32 pcre2fuzzsupport.c...

OSV-2026-341 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488745540 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

OSV-2025-1075 Stack-use-after-return in mark_alt_bonds_and_taut_groups

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488729177 Crash type: Stack-use-after-return READ 2 Crash state: markaltbondsandtautgroups CreateINChI MakeOneInChIOutOfStrFromINChI...

OSV-2026-338 Use-of-uninitialized-value in pjsip_auth_clt_init_req

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488721002 Crash type: Use-of-uninitialized-value Crash state: pjsipauthcltinitreq fuzz-sip.c fuzz-sip.c...

OSV-2026-324 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488130836 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

OSV-2026-311 UNKNOWN READ in strncasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponentstringtokind parsevcard...

OSV-2026-308 Heap-buffer-overflow in vcardstructured_new_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486715154 Crash type: Heap-buffer-overflow WRITE 8 Crash state: vcardstructurednewfromstring vcardparametersetvaluefromstring parsevcard...

OSV-2026-307 Global-buffer-overflow in navcom_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486709178 Crash type: Global-buffer-overflow READ 1 Crash state: navcomparse gpsdpoll FuzzDrivers.c...

OSV-2026-304 Heap-use-after-free in tf::Executor::_invoke

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486618382 Crash type: Heap-use-after-free READ 4 Crash state: tf::Executor::invoke tf::Executor::spawn void std::1::threadproxy...

OSV-2026-302 Use-of-uninitialized-value in BIO_new_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486713209 Crash type: Use-of-uninitialized-value Crash state: BIOnewfile libcrypto.so.3 CONFmodulesloadfileex...

OSV-2026-301 Use-of-uninitialized-value in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486705308 Crash type: Use-of-uninitialized-value Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2026-300 UNKNOWN WRITE in nmeaid_to_prn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486727024 Crash type: UNKNOWN WRITE Crash state: nmeaidtoprn processGSV nmeaparse...

OSV-2026-297 Security exception in org.apache.poi.util.IOUtils.safelyAllocate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486522036 Crash type: Security exception Crash state: org.apache.poi.util.IOUtils.safelyAllocate org.apache.poi.hssf.record.RecordInputStream.readRemainder org.apache.poi.hssf.record.UnknownRecord...

OSV-2026-292 UNKNOWN WRITE in <wasmtime::runtime::func::Func>::call_unchecked_raw::<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486503337 Crash type: UNKNOWN WRITE Crash state: ::calluncheckedraw::::queuecall...

OSV-2026-272 Heap-use-after-free in vcardproperty_get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=485932113 Crash type: Heap-use-after-free READ 8 Crash state: vcardpropertygetvalue vcardpropertygetversion parsevcard...