What is considered as a vulnerability in the C++ decompiler?

[niooss-ledger]

Hello,
As I use Ghidra to sometimes analyse malware, I was curious whether there could be any vulnerabilities in the decompiler. I did a bit of fuzzing and managed to have several crashes/type-confusion issues/... but none of the findings seem to be reachable from a malicious loaded program (which is nice!). For example, if a type is defined in a specific way in the DataType Manager, the decompiler process does an out-of-bound read and crashes. It also found that when decomp_dbg restores some crafted XML files, a C++ class confusion can be triggered (bad cast of an object pointer).

Should such issues be considered security vulnerabilities and reported through GitHub's private vulnerability reporting?