OSV-2026-1196

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/hobbes/OSV-2026-1196.yaml
JSON Data
https://api.osv.dev/v1/vulns/OSV-2026-1196
Published
2026-08-25T00:09:47Z
Modified
2026-08-25T00:09:47Z
Summary
Heap-buffer-overflow in yylex
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=551147457

Crash type: Heap-buffer-overflow WRITE 4
Crash state:
yylex
yyparse
hobbes::runParserOnBuffer
References

Affected packages

OSS-Fuzz / hobbes

Package

Name
hobbes
Purl
pkg:generic/hobbes

Affected ranges

Type
GIT
Repo
https://github.com/morganstanley/hobbes.git
Events
Introduced
bd8cb86615562113ae09e837b8447d22dd945e80
Fixed
3d08bc2cd3474bb3c41bfb21dc3c7b0b1109e5e7

Ecosystem specific 

{
    "severity": "HIGH"
}

Database specific

fixed_range 
"a3405671223691e74f0734b36d751b3cb4b7d24d:3d08bc2cd3474bb3c41bfb21dc3c7b0b1109e5e7"
introduced_range 
"unknown:bd8cb86615562113ae09e837b8447d22dd945e80"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/hobbes/OSV-2026-1196.yaml"