Song Li

issue-6664: Heap OOB read in FriendlyNameMapper OpTypePointer (spirv-tools)

issue-1986: Memory leak in _lou_resolveTable with custom table resolver (liblouis)

Issue #1318: Unbounded allocation in ReadBlock via crafted SSTable (leveldb)

issue-1194: OOB read in OBJ decoder DeduplicateFormattedValues (draco)

issue-1746: Heap buffer overflow in heif_image_crop via integer underflow (libheif)

issue-1175: UAF in CleanNode when TidyGDocClean enabled (tidy-html5)

issue-125: Memory leak in _vorbis_unpack_comment during multi-stream file open (vorbis)

issue-6663: SEGV in OrderBlocks via empty CFG (spirv-tools)

issue-9041: Heap buffer overflow in FlexBuffers ToString post-verification (flatbuffers)

issue-30911: NULL pointer write in EVP_PKEY_CTX_get_rsa_padding (openssl)

issue-1222: Signed integer overflow in gzseek64 (zlib)

Issue 1144: Shift exponent too large in ares_calc_query_timeout (c-ares)

issue-30921: NULL deref in DH paramgen type translation (openssl)

issue-1631: READ SEGV in opj_tcd_get_decoded_tile_size (openjpeg)

CVE-2023-39327: Infinite loop via malicious JPEG2000 codestream (openjpeg)

protobuf#26857: NULL deref in upb_MiniTableEnum_CheckValue (unlinked enum)

issue-112757: MapUnstageNoKey CHECK crash on out-of-bounds index (tensorflow)

issue-28598: UBSan left shift of negative value in FillConvexPoly (opencv)

issue-181510: UBSan null pointer in Vectorized<float>::loadu (pytorch)

issue-162476: heap-buffer-overflow in quantized_max_pool2d (pytorch)

CVE-2026-32316: Integer overflow in jvp_string_append causes heap-buffer-overflow (jq)

CVE-2026-21869: OOB write via negative n_discard in llama-server (llama.cpp)

CVE-2025-9809: stack-buffer-overflow in cdfs_open_cue_track (libretro-common)