OSV-2026-981

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2026-981.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/OSV-2026-981
Published
2026-06-27T00:19:11.500567Z
Modified
2026-06-29T12:15:07.215664469Z
Summary
Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527773834

Crash type: Heap-buffer-overflow WRITE 4
Crash state:
std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre
std::__1::__function::__func<grk::CodeStreamDecompress::postMultiTile
grk::CodeStreamDecompress::wait
References

Affected packages

OSS-Fuzz / grok

Package

Name
grok
Purl
pkg:generic/grok

Affected ranges

Type
GIT
Repo
https://github.com/GrokImageCompression/grok.git
Events
Introduced
152eec18b4770b875be691a2afc333bcd6d725aa
Fixed
f76c6e85fcf629f7dc5b961e37f4fefb00ce7c7e

Affected versions

v20.*
v20.3.5
v20.3.6

Ecosystem specific 

{
    "severity": "HIGH"
}

Database specific

fixed_range 
"82ce38159c68ac6da531682dc542bbbdf32c15b9:f76c6e85fcf629f7dc5b961e37f4fefb00ce7c7e"
introduced_range 
"432a2a59cb1995c89e63ca527dfe4adee70f6a99:4517ebc350ce24e46291d07e2883c0b1c7363f9f"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2026-981.yaml"