Private security contact for multiple snapshot loader memory corruption issues

Author: damselengCreated Jun 17, 2026Updated Jun 17, 2026

Hello,

I found multiple reproducible memory-safety issues in JerryScript's snapshot loader, reachable through jerry --exec-snapshot and the jerry_exec_snapshot() API.

The issues include heap-buffer-overflow reads, global-buffer-overflow access, and release-build crashes with crafted .snap files. I have a minimized PoC package with ASan/UBSan logs, plain release reproduction logs, root-cause analysis, and suggested fixes.

I do not want to publish PoCs or detailed crash input structure in a public issue. Could you please let me know the preferred private channel for reporting security issues, or enable GitHub private vulnerability reporting for this repository?

Thank you.

Source: jerryscript-project/jerryscript