Private security contact for multiple snapshot loader memory corruption issues
Author: damselengCreated Jun 17, 2026Updated Jun 17, 2026
Hello,
I found multiple reproducible memory-safety issues in JerryScript's snapshot loader, reachable through jerry --exec-snapshot and the jerry_exec_snapshot() API.
The issues include heap-buffer-overflow reads, global-buffer-overflow access, and release-build crashes with crafted .snap files. I have a minimized PoC package with ASan/UBSan logs, plain release reproduction logs, root-cause analysis, and suggested fixes.
I do not want to publish PoCs or detailed crash input structure in a public issue. Could you please let me know the preferred private channel for reporting security issues, or enable GitHub private vulnerability reporting for this repository?
Thank you.
Source: jerryscript-project/jerryscript