Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Google's OSS-Fuzz Finds Crash in Google's Cryptofuzz Library
published 6 years ago
Summary
A bug in Google's Cryptofuzz library can cause it to crash when used in certain situations. This bug affects the security of systems using Cryptofuzz, but it's not clear how easily an attacker could exploit it. Users should update to the latest version of Cryptofuzz to prevent crashes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| OSS-Fuzz | – | cryptofuzz | All versions |
Original advisory text
Use-of-uninitialized-value in fuzzing::memory::memory_test_msan
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25181
```
Crash type: Use-of-uninitialized-value
Crash state:
fuzzing::memory::memory_test_msan
cryptofuzz::ExecutorBase<cryptofuzz::Buffer, cryptofuzz::operation::CMAC>::postp
cryptofuzz::ExecutorBase<cryptofuzz::Buffer, cryptofuzz::operation::CMAC>::Run
```
```
Crash type: Use-of-uninitialized-value
Crash state:
fuzzing::memory::memory_test_msan
cryptofuzz::ExecutorBase<cryptofuzz::Buffer, cryptofuzz::operation::CMAC>::postp
cryptofuzz::ExecutorBase<cryptofuzz::Buffer, cryptofuzz::operation::CMAC>::Run
```
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25181 Third Party Advisory
Timeline
Published25 Aug 2020
Updated6 Mar 2026
First seen6 Mar 2026
Track software like this
Free during beta