{"id":"OSV-2025-298","aliases":[],"status":"published","title":"Heap-buffer-overflow in i18n::phonenumbers::UnicodeText::const_iterator::operator--","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413161357\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ni18n::phonenumbers::UnicodeText::const_iterator::operator--\ni18n::phonenumbers::UnicodeString::tempSubString\ni18n::phonenumbers::AsYouTypeFormatter::AttemptToExtractIdd\n```","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-04-26T00:02:46.771719Z","modified":"2026-10-20T17:27:22Z","affected":[{"source":"osv","ecosystem":"OSS-Fuzz","package":"libphonenumber","ranges":[{"type":"GIT","events":[{"introduced":"78d634f33ae4966e2283ab2d59a300a768b6e174"},{"fixed":"669751dd889a2daf135580caf5cb54f41fa0bc2d"},{"fixed":"6167d42b7ea67eedca61468a7fb9da1523703054"}]}],"versions":["v9.0.16","v9.0.15","v9.0.14","v9.0.13","v9.0.12","v9.0.11","v9.0.10","v9.0.9","v9.0.8","v9.0.7","v9.0.6","v9.0.5","v9.0.4"]}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413161357","tags":["report"]}],"sources":{"osv":[{"id":"OSV-2025-298","title":"Heap-buffer-overflow in i18n::phonenumbers::UnicodeText::const_iterator::operator--","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413161357\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ni18n::phonenumbers::UnicodeText::const_iterator::operator--\ni18n::phonenumbers::UnicodeString::tempSubString\ni18n::phonenumbers::AsYouTypeFormatter::AttemptToExtractIdd\n```\n","status":"published","published":"2025-04-26T00:02:46.771719Z","modified":"2026-10-20T17:27:22.667883206Z","updated_at":"2026-11-02T15:52:49.981578Z"}]}}