CVE-2026-8696

radare2 6.1.5 contains a use-after-free vulnerability in the gdbrpidslist function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability ...

CVE-2026-8696

CVE-2026-8696 affects radare2 6.1.5, specifically the GDB client core's gdbr_pids_list() function. The vulnerability is a use-after-free that can be triggered by malformed thread information responses, where qsThreadInfo fails after qfThreadInfo allocates RDebugPid structures. This leads to a dou...