OSV-2025-600 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=436037111 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack Imf34::ScanLineInputFile::Data::readPixels Imf34::InputFile::readPixels...

OSV-2025-597 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435779241 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack exrdecodingrun Imf34::ScanLineProcess::rundecode...

OSV-2025-593 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435479026 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatget ljvmetatgetv...

OSV-2025-591 UNKNOWN READ in mov_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435536867 Crash type: UNKNOWN READ Crash state: movreadheader avformatopeninput demuxopenlavf...

OSV-2025-589 Heap-buffer-overflow in isvcd_decode_recon_tfr_nmb_base_lyr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435086517 Crash type: Heap-buffer-overflow READ 1 Crash state: isvcddecoderecontfrnmbbaselyr isvcdparseinterslicedatacabac isvcdparsepslice...

OSV-2025-584 Heap-buffer-overflow in isvcd_mark_err_slice_skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434978682 Crash type: Heap-buffer-overflow READ 2 Crash state: isvcdmarkerrsliceskip isvcdvideodecode Codec::decodeFrame...

OSV-2025-581 UNKNOWN READ in tidy_fuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434741279 Crash type: UNKNOWN READ Crash state: tidyfuzzer...

OSV-2025-580 UNKNOWN READ in signed char Assimp::StreamReader<false, false>::Get<signed char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434414094 Crash type: UNKNOWN READ Crash state: signed char Assimp::StreamReader::Get Assimp::COBImporter::ReadBinaryFile Assimp::COBImporter::InternReadFile...

OSV-2025-570 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=433311401 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.io.BufferedWriter.write java.base/java.io.Writer.write...

OSV-2025-565 Heap-buffer-overflow in pcpp::IPv6Address::IPv6Address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=432892652 Crash type: Heap-buffer-overflow READ 16 Crash state: pcpp::IPv6Address::IPv6Address pcpp::SomeIpSdIPv6Option::getIpAddress readParsedPacket...

OSV-2025-564 Heap-buffer-overflow in ndpi_match_host_subprotocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=432880859 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol processrequest...

OSV-2025-550 Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_subr_subset_t, CFF::subr_subset_param_t, CFF:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=431867896 Crash type: Use-of-uninitialized-value Crash state: CFF::cff2csopsettcff2csopsetsubrsubsett, CFF::subrsubsetparamt, CFF: cff2csopsetsubrsubsett::processop CFF::subrsubsettertcff2subrsubsettert,...

OSV-2025-547 Security exception in com.alibaba.fastjson2.JSONReader.readArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=431584944 Crash type: Security exception Crash state: com.alibaba.fastjson2.JSONReader.readArray java.base/java.nio.charset.CharsetEncoder. java.base/java.nio.charset.CharsetEncoder...

OSV-2025-544 Heap-buffer-overflow in N_BELE_RTP::LEPolicy::get32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110068 Crash type: Heap-buffer-overflow READ 4 Crash state: NBELERTP::LEPolicy::get32 PackLinuxElf32::elflookup PackLinuxElf32::PackLinuxElf32help1...

OSV-2025-542 Use-of-uninitialized-value in httpEncode64_3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110066 Crash type: Use-of-uninitialized-value Crash state: httpEncode643 fuzzhttpcore.c fuzzhttpcore.c...

OSV-2025-541 Heap-buffer-overflow in js_create_function

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091578 Crash type: Heap-buffer-overflow READ 2 Crash state: jscreatefunction JSEvalInternal JSEvalObject...

OSV-2025-538 Heap-double-free in policydb_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091583 Crash type: Heap-double-free Crash state: policydbdestroy checkpolicy-fuzzer.c definegenfscontext...

OSV-2025-534 Heap-use-after-free in ih264_inter_pred_luma_horz_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428771938 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumahorzssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...

OSV-2025-530 Invalid-free in cli_pdf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429489013 Crash type: Invalid-free Crash state: clipdf cliscanpdf climagicscan...

OSV-2025-528 Heap-buffer-overflow in xmlnode_parser_structural_error_libxml

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429429092 Crash type: Heap-buffer-overflow WRITE 4 Crash state: xmlnodeparserstructuralerrorlibxml xmlRaiseError xmlParseAttValueInternal...

OSV-2025-525 UNKNOWN READ in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429429085 Crash type: UNKNOWN READ Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

OSV-2025-524 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429330008 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal asyncfuncresume jsasyncfunctionresume...

OSV-2025-515 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754593 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OSV-2025-512 Invalid-free in pdf_decodestream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754704 Crash type: Invalid-free Crash state: pdfdecodestream pdfextractobj clipdf...

OSV-2025-510 Use-after-poison in llvm::BitstreamCursor::readRecord

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428525443 Crash type: Use-after-poison READ 1 Crash state: llvm::BitstreamCursor::readRecord BitcodeReader::parseModule llvm::BitcodeModule::getModuleImpl...

OSV-2025-500 UNKNOWN READ in getUShort

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428022218 Crash type: UNKNOWN READ Crash state: getUShort disInstrTHUMBWRK disInstrARM...

OSV-2025-491 Heap-buffer-overflow in libssl.soNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=427814448 Crash type: Heap-buffer-overflow READ 5 Crash state: libssl.soNUMBER libssl.soNUMBER SSLCTXsetcipherlist...

OSV-2025-486 Bad-cast to cv::PngDecoder from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=426783958 Crash type: Bad-cast Crash state: Bad-cast to cv::PngDecoder from invalid vptr cv::PngDecoder::readData cv::imdecode...

OSV-2025-485 Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=426843906 Crash type: Use-of-uninitialized-value Crash state: pcpp::IDnsResource::decodeName pcpp::IDnsResource::IDnsResource pcpp::DnsLayer::parseResources...

OSV-2025-484 Heap-buffer-overflow in load_protocols_file_fd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=426164365 Crash type: Heap-buffer-overflow READ 2 Crash state: loadprotocolsfilefd fuzzfilecfgprotocols.c...

OSV-2025-481 Stack-buffer-overflow in void glz::from<10000u, int>::op<glz::opts_csv{10000u,

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=425730091 Crash type: Stack-buffer-overflow READ 1 Crash state: void glz::from::op::op::opglz::optscsv10000u,...

OSV-2025-480 Stack-buffer-overflow in void glz::from<10000u, std::__1::__bit_reference<std::__1::vector<bool, std::__1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=425725152 Crash type: Stack-buffer-overflow READ 1 Crash state: void glz::from::op::opglz::optscsv10000u,...

OSV-2025-469 Use-of-uninitialized-value in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424653416 Crash type: Use-of-uninitialized-value Crash state: ndpistrdup ndpidetectionprocesspacket fuzzconfig.cpp...

OSV-2025-467 Security exception in java.base/java.lang.StringUTF16.newBytesFor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424839378 Crash type: Security exception Crash state: java.base/java.lang.StringUTF16.newBytesFor java.base/java.lang.AbstractStringBuilder.inflate java.base/java.lang.AbstractStringBuilder.append...

OSV-2025-466 Security exception in java.base/java.lang.AbstractStringBuilder.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424617284 Crash type: Security exception Crash state: java.base/java.lang.AbstractStringBuilder. java.base/java.lang.StringBuilder. com.ctc.wstx.util.StringUtil.normalizeSpaces...

OSV-2025-465 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424613315 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseNotationDecl...

OSV-2025-461 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424229869 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseDocTypeDecl...

OSV-2025-457 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424242614 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseEntityDecl...

OSV-2025-456 Use-of-uninitialized-value in ppd_hash_option

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423674620 Crash type: Use-of-uninitialized-value Crash state: ppdhashoption cupsArrayFind ppdFindOption...

OSV-2025-454 Use-of-uninitialized-value in _cups_strcasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423573723 Crash type: Use-of-uninitialized-value Crash state: cupsstrcasecmp ppdloadconstraints ppdConflicts...

OSV-2025-449 Heap-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422832557 Crash type: Heap-buffer-overflow READ 11 Crash state: checkcontenttypeandchangeprotocol processrequest ndpicheckhttptcp...

OSV-2025-447 Use-of-uninitialized-value in spvtools::EmitNumericLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423059200 Crash type: Use-of-uninitialized-value Crash state: spvtools::EmitNumericLiteral spvtools::disassemble::InstructionDisassembler::EmitOperand spvtools::disassemble::InstructionDisassembler::EmitInstructionImpl...

OSV-2025-444 Security exception in com.drew.imaging.quicktime.QuickTimeReader.processAtoms

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422822305 Crash type: Security exception Crash state: com.drew.imaging.quicktime.QuickTimeReader.processAtoms com.drew.lang.StreamReader.getByte com.drew.lang.SequentialReader.getUInt32...

OSV-2024-1446 Segv on unknown address in glslang::TIntermediate::addSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422517700 Crash type: Segv on unknown address Crash state: glslang::TIntermediate::addSymbol glslang::HlslParseContext::handleFunctionCall glslang::HlslParseContext::transformEntryPoint...

OSV-2025-442 Security exception in org.jsoup.parser.HtmlTreeBuilder.process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422516687 Crash type: Security exception Crash state: org.jsoup.parser.HtmlTreeBuilder.process org.jsoup.parser.HtmlTreeBuilderState$8.process org.jsoup.parser.TreeBuilder.currentElement...

OSV-2025-437 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=421943174 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatget ljvmetatgetv...

OSV-2025-436 Security exception in graphql.parser.GraphqlAntlrToLanguage.createNonNullType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217211 Crash type: Security exception Crash state: graphql.parser.GraphqlAntlrToLanguage.createNonNullType graphql.parser.GraphqlAntlrToLanguage.createType graphql.parser.GraphqlAntlrToLanguage.createListType...

OSV-2025-433 Null-dereference READ in _libssh2_packet_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217191 Crash type: Null-dereference READ Crash state: libssh2packetadd fullpacket libssh2transportread...

OSV-2025-424 UNKNOWN READ in RDKit::RDValue::destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=421736524 Crash type: UNKNOWN READ Crash state: RDKit::RDValue::destroy RDKit::Dict::clearVal RDKit::RDProps::clearProp...

OSV-2025-419 Security exception in org.apache.lucene.util.AttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420955259 Crash type: Security exception Crash state: org.apache.lucene.util.AttributeImpl.clone org.apache.lucene.util.AttributeSource$State.clone org.apache.lucene.util.AttributeSource$State.clone...