OSV-2025-1064 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476224468 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

OSV-2025-1061 Security exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<ini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431391 Crash type: Security exception Crash state: org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup. org.apache.poi.hssf.record.aggregates.SharedValueManager.create...

OSV-2025-1059 Security exception in com.google.re2j.Machine.add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431390 Crash type: Security exception Crash state: com.google.re2j.Machine.add com.google.re2j.Machine$Thread. com.google.re2j.Machine.alloc...

OSV-2026-76 Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476170180 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement org.htmlunit.cyberneko.HTMLElements$HTMLElementsWithCache.getElement...

OSV-2026-74 Heap-buffer-overflow in ___interceptor_strtol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476180586 Crash type: Heap-buffer-overflow READ 3 Crash state: interceptorstrtol Assimp::ObjFileParser::getFace Assimp::ObjFileParser::parseFile...

OSV-2026-65 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476179553 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop java.base/sun.nio.cs.UTF8$Encoder.encodeLoop...

OSV-2026-57 Heap-buffer-overflow in mkv::matroska_segment_c::TrackInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475261418 Crash type: Heap-buffer-overflow READ 1 Crash state: mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::ParseTrackEntry...

OSV-2026-55 Use-of-uninitialized-value in vp9_quantize_fp_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475583924 Crash type: Use-of-uninitialized-value Crash state: vp9quantizefpavx2 blockyrd vp9pickintermode...

OSV-2026-54 Heap-use-after-free in _dwarf_exec_frame_instr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475563464 Crash type: Heap-use-after-free READ 8 Crash state: dwarfexecframeinstr dwarfgetfdeinfoforapcrow dwarfgetfdeinfoforallregs3b...

OSV-2026-53 Heap-use-after-free in graph::LigatureSubstFormat1::shrink

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475607265 Crash type: Heap-use-after-free READ 8 Crash state: graph::LigatureSubstFormat1::shrink graph::LigatureSubstFormat1::splitcontextt::shrink hbvectort graph::actuatesubtablesplitgraph::LigatureSu...

OSV-2026-49 Heap-buffer-overflow in check_sync_pes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475305126 Crash type: Heap-buffer-overflow READ Crash state: checksyncpes Demux demuxprocessstream...

OSV-2026-44 UNKNOWN READ in MP4_TrackSeek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475299914 Crash type: UNKNOWN READ Crash state: MP4TrackSeek DemuxMoov Demux...

OSV-2026-36 Heap-buffer-overflow in iTUNTripletCallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474821719 Crash type: Heap-buffer-overflow READ 4 Crash state: iTUNTripletCallback SetupMeta MP4LoadMeta...

OSV-2026-30 Use-of-uninitialized-value in vp9_quantize_fp_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474614578 Crash type: Use-of-uninitialized-value Crash state: vp9quantizefpavx2 blockyrd vp9pickintermode...

OSV-2026-29 Heap-double-free in local_parse_glob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474561494 Crash type: Heap-double-free Crash state: localparseglob sshbindconfigparseline sshbindconfigparsestring...

OSV-2026-21 Use-of-uninitialized-value in processTLSBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474015854 Crash type: Use-of-uninitialized-value Crash state: processTLSBlock ndpisearchdtls ndpisearchtlswrapper...

OSV-2026-19 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=473884569 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.String. org.antlr.v4.runtime.CodePointCharStream$CodePoint8BitCharStream.getText...

OSV-2026-6 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472785101 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.primary...

OSV-2026-4 UNKNOWN READ in rb_managed_id_table_lookup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472871119 Crash type: UNKNOWN READ Crash state: rbmanagedidtablelookup vmlookupcc rbvmsearchmethodslowpath...

OSV-2026-2 Heap-buffer-overflow in cmt_mpack_consume_uint_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472785094 Crash type: Heap-buffer-overflow WRITE 8 Crash state: cmtmpackconsumeuinttag cmtmpackunpackarray cmtmpackunpackmap...

OSV-2025-1049 Heap-buffer-overflow in unsigned char* std::__1::vector<unsigned char, std::__1::allocator<unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472222304 Crash type: Heap-buffer-overflow READ 1 Crash state: unsigned char std::1::vectorunsigned char, std::1::allocatorunsigned char pcpp::TLSECPointFormatExtension::getECPointFormatList...

OSV-2025-1039 UNKNOWN WRITE in fuzz_regexp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471926738 Crash type: UNKNOWN WRITE Crash state: fuzzregexp...

OSV-2025-1020 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471093652 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatset ljvmetatsetv...

OSV-2025-1018 Stack-buffer-overflow in lre_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471304472 Crash type: Stack-buffer-overflow READ 8 Crash state: lreexec fuzzregexp.c...

OSV-2025-1016 Use-of-uninitialized-value in js_create_function

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471075808 Crash type: Use-of-uninitialized-value Crash state: jscreatefunction JSEvalInternal JSEvalObject...

OSV-2025-1004 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=470469212 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

OSV-2025-1001 Dynamic-stack-buffer-overflow in _ox_err_set_with_location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=470447384 Crash type: Dynamic-stack-buffer-overflow READ 1 Crash state: oxerrsetwithlocation readtext readelement...

OSV-2025-994 Heap-buffer-overflow in rx_icmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=469520969 Crash type: Heap-buffer-overflow READ 1 Crash state: rxicmp mgtcpiprx fuzz.c...

OSV-2025-989 Bad-cast to UT_hash_bucket' (aka 'struct UT_hash_bucket')password_file__cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=468922225 Crash type: Bad-cast Crash state: Bad-cast to UThashbucket' aka 'struct UThashbucket'passwordfilecleanup mosquittosecuritycleanupdefault brokerfuzzpasswordfile.cpp...

OSV-2025-983 Dynamic-stack-buffer-overflow in _ox_err_set_with_location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=468138858 Crash type: Dynamic-stack-buffer-overflow READ 1 Crash state: oxerrsetwithlocation readelement oxparse...

OSV-2025-970 Heap-buffer-overflow in check_sync_pes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=465802762 Crash type: Heap-buffer-overflow READ Crash state: checksyncpes Demux demuxprocessstream...

OSV-2025-965 Stack-use-after-scope in Assimp::FBX::FBXExportProperty::FBXExportProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=465494996 Crash type: Stack-use-after-scope READ 1 Crash state: Assimp::FBX::FBXExportProperty::FBXExportProperty Assimp::FBX::FBXExportProperty std::1::vectorAssimp::FBX::FBXExportProperty, Assimp::FBXExporter::WriteObjects...

OSV-2025-959 Heap-buffer-overflow in re_parse_term

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=464349132 Crash type: Heap-buffer-overflow READ 2 Crash state: reparseterm reparsedisjunction reparseterm...

OSV-2025-955 Use-of-uninitialized-value in decoder_context::construct_reference_picture_lists

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=464323256 Crash type: Use-of-uninitialized-value Crash state: decodercontext::constructreferencepicturelists decodercontext::processslicesegmentheader decodercontext::readsliceNAL...

OSV-2025-938 Use-of-uninitialized-value in comp_func_SourceOver_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462673332 Crash type: Use-of-uninitialized-value Crash state: compfuncSourceOveravx2 blenduntransformedgeneric blenduntransformedgeneric...

OSV-2025-932 Heap-use-after-free in password_file__cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462551340 Crash type: Heap-use-after-free READ 8 Crash state: passwordfilecleanup mosquittosecuritycleanupdefault brokerfuzzpasswordfile.cpp...

OSV-2025-930 Dynamic-stack-buffer-overflow in _ox_err_set_with_location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462353164 Crash type: Dynamic-stack-buffer-overflow READ 1 Crash state: oxerrsetwithlocation readelement oxparse...

OSV-2025-926 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462261562 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt...

OSV-2025-906 Use-of-uninitialized-value in QImage::pixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461199967 Crash type: Use-of-uninitialized-value Crash state: QImage::pixel XCFImageFormat::copyGrayAToRGB XCFImageFormat::copyLayerToImage...

OSV-2025-901 Heap-use-after-free in apache::thrift::protocol::TCompactProtocolT<apache::thrift::transport::TMemoryBu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461058054 Crash type: Heap-use-after-free READ 1 Crash state: apache::thrift::protocol::TCompactProtocolTapache::thrift::transport::TMemoryBu unsigned int parquet::format::OffsetIndex::readapache::thrift::protocol::TCompa void...

OSV-2025-900 Heap-buffer-overflow in DecodeFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=460575093 Crash type: Heap-buffer-overflow READ Crash state: DecodeFrame testdecoderprocess EsOutSend...

OSV-2025-890 Heap-buffer-overflow in icalmemory_tmp_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458943970 Crash type: Heap-buffer-overflow WRITE 1 Crash state: icalmemorytmpcopy icalreqstattypefromstring icalvaluenewfromstring...

OSV-2025-884 Heap-use-after-free in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458199402 Crash type: Heap-use-after-free READ 8 Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-879 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457858149 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-876 Stack-buffer-overflow in snmp_input

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457106694 Crash type: Stack-buffer-overflow READ 8 Crash state: snmpinput snmpparsetrapfuzzer.c...

OSV-2025-871 UNKNOWN READ in ojph::local::param_cod::~param_cod

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=456837230 Crash type: UNKNOWN READ Crash state: ojph::local::paramcod::paramcod ojph::local::paramcod::paramcod ojph::local::paramcod::paramcod...

OSV-2025-865 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=456158449 Crash type: Heap-buffer-overflow READ 4 Crash state: genericunpack Imf34::ScanLineInputFile::Data::readPixels Imf34::InputFile::readPixels...

OSV-2025-858 Use-of-uninitialized-value in pcpp::byteArrayToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454944849 Crash type: Use-of-uninitialized-value Crash state: pcpp::byteArrayToHexString pcpp::PacketTrailerLayer::toString FuzzTarget.cpp...

OSV-2025-857 Global-buffer-overflow in void jxl::N_AVX2::WriteToOutputStage::StoreUnsignedRow<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454749502 Crash type: Global-buffer-overflow READ 16 Crash state: void jxl::NAVX2::WriteToOutputStage::StoreUnsignedRow jxl::NAVX2::WriteToOutputStage::OutputBuffers jxl::NAVX2::WriteToOutputStage::ProcessRow...

OSV-2025-855 Use-of-uninitialized-value in AlphaReplace_SSE2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454314139 Crash type: Use-of-uninitialized-value Crash state: AlphaReplaceSSE2 WebPReplaceTransparentPixels WebPEncode...