Total
170 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40527 | 1 Radare | 1 Radare2 | 2026-07-14 | N/A | 7.8 HIGH |
| radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string. | |||||
| CVE-2026-14760 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue. | |||||
| CVE-2026-14759 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch. | |||||
| CVE-2026-14758 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue. | |||||
| CVE-2026-14787 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue. | |||||
| CVE-2026-14788 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue. | |||||
| CVE-2026-14789 | 1 Radare | 1 Radare2 | 2026-07-09 | 1.7 LOW | 3.3 LOW |
| A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue. | |||||
| CVE-2026-14757 | 1 Radare | 1 Radare2 | 2026-07-07 | 4.3 MEDIUM | 5.3 MEDIUM |
| A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. | |||||
| CVE-2026-14786 | 1 Radare | 1 Radare2 | 2026-07-07 | 1.7 LOW | 3.3 LOW |
| A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulation results in integer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 11ac224c0eb8d57830fccc99e1c1cd8e5d958813. It is best practice to apply a patch to resolve this issue. | |||||
| CVE-2026-14761 | 1 Radare | 1 Radare2 | 2026-07-06 | 1.7 LOW | 3.3 LOW |
| A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-8696 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 7.5 HIGH |
| radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list. | |||||
| CVE-2026-8695 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 7.5 HIGH |
| radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing. | |||||
| CVE-2026-6941 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 6.6 MEDIUM |
| radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory. | |||||
| CVE-2026-6940 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 7.1 HIGH |
| radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss. | |||||
| CVE-2026-40517 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 7.8 HIGH |
| radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator. | |||||
| CVE-2026-40499 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 7.8 HIGH |
| radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file. | |||||
| CVE-2025-63745 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 5.5 MEDIUM |
| A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data. | |||||
| CVE-2025-63744 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 4.3 MEDIUM |
| A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program. | |||||
| CVE-2025-60361 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 3.3 LOW |
| radare2 v5.9.8 and before contains a memory leak in the function bochs_open. | |||||
| CVE-2025-60360 | 1 Radare | 1 Radare2 | 2026-06-17 | N/A | 5.5 MEDIUM |
| radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init. | |||||