OSV-2026-437

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2026-437.yaml
JSON Data
https://api.osv.dev/v1/vulns/OSV-2026-437
Published
2026-03-23T00:02:28.277984Z
Modified
2026-03-23T14:25:41.819255Z
Summary
Heap-use-after-free in tf::Executor::_invoke
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=494709474

Crash type: Heap-use-after-free WRITE 8
Crash state:
tf::Executor::_invoke
tf::Executor::_spawn
void* std::__1::__thread_proxy
References

Affected packages

OSS-Fuzz / grok

Package

Name
grok
Purl
pkg:generic/grok

Affected ranges

Type
GIT
Repo
https://github.com/GrokImageCompression/grok.git
Events
Introduced
1ca9a4ce1b63568ed43aa7c93697114dc6b3fbcb
Fixed
84d94206198d183bce6af08a15ecac78a9f4d951
Fixed
1332b833ac7b1c9596e4f771ab2b3f1b13f62d99

Affected versions

v20.*
v20.1.0
v20.2.0

Ecosystem specific 

{
    "severity": "HIGH"
}

Database specific

fixed_range 
"c2fe0160c9e3bf01ff5b91501128748ab83aae1c:1332b833ac7b1c9596e4f771ab2b3f1b13f62d99"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2026-437.yaml"
introduced_range 
"354d77e68ddea42a4d8068ac5a92e32035848fb7:b176c52456b31ee223c82ed2c765471b190bc18a"