CVE-2025-5648

Radare2 5.9.9 (radiff2) is affected by CVE-2025-5648. The vulnerability is in r_cons_pal_init (libr/cons/pal.c) where manipulation of the -T argument leads to memory corruption. It requires local access with a high attack complexity; exploitability is rated as difficult. The patch is identified a...

CVE-2019-14745

Radare2 CVE-2019-14745 is a command-injection flaw in bin_symbols() (libr/core/cbin.c) present in versions before 3.7.0, due to improper handling of symbol names embedded in executables. By feeding a crafted binary, an attacker could execute arbitrary shell commands with the victim’s privileges. ...

CVE-2022-0713

CVE-2022-0713 describes a heap-based buffer overflow in the radare2 project (GitHub: radareorg/radare2) prior to version 5.6.4. The vulnerability arises from a heap overflow in the software’s handling of input via its radare2 components, with reported impacts consistent with a high-severity local...

CVE-2019-19647

Radare2 up to version 4.0.0 is vulnerable to CVE-2019-19647 due to missing validation of the content variable in r_asm_pseudo_incbin (libr/asm/asm.c), which can cause an arbitrary write and lead to a denial of service (application crash) or other impact. Mitigation is to upgrade to radare2 4.2.1 ...

CVE-2019-12829

CVE-2019-12829 affects radare2 up to version 3.5.1, where mishandling the RParse API can cause a denial of service (application crash) and possibly other impact, demonstrated by newstr buffer overflows during replace operations. The issue specifically involves the code paths in libr/asm/asm.c and...

CVE-2022-0476

CVE-2022-0476 affects radare2 prior to 5.6.4, with a documented Denial of Service in the GitHub repository radareorg/radare2. Multiple sources (NVD entry and vendor advisories) confirm the issue impacts versions before 5.6.4 and note that patches released as part of radare2 5.6.4 mitigate the vul...

CVE-2022-0676

CVE-2022-0676 corresponds to a heap-based buffer overflow in radare2 (radareorg/radare2) prior to version 5.6.4. The connected entries consistently describe a vulnerability in the radare2 codebase that is triggered by handling crafted inputs, leading to heap overflow. Affected products/packaged d...

CVE-2022-0518

CVE-2022-0518 covers a heap-based buffer overflow in radare2 (radareorg/radare2) prior to 5.6.2. Connected sources corroborate the issue across multiple OS packages and advisories, with references to an upstream fix trajectory (e.g., later distro updates such as radare2 5.6.x series). Public deta...

CVE-2022-0695

CVE-2022-0695 affects radare2 (GitHub radareorg/radare2). The vulnerability is a Denial of Service in versions prior to 5.6.4, caused by a bug in the code path that leads to resource exhaustion. Public sources in the connected documents indicate a DoS impact and reference the patch release throug...

CVE-2022-0712

CVE-2022-0712: NULL Pointer Dereference in radare2 (radareorg/radare2) prior to 5.6.4. The issue affects the radare2 project and can impact availability (CVSSv3.1: A=High) with local access requirements. The patched version is 5.6.4 ( Fedora updates and vendor advisories confirm remediation). Oth...

CVE-2023-0302

Technical details (affected components, exact impact, exploitation) are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

CVE-2022-1031

CVE-2022-1031 affects radare2 (radareorg/radare2) prior to version 5.6.6, due to a use-after-free in the op_is_set_bp path. The vulnerability resides in the memory management of that directive, enabling memory corruption that can lead to a crash or broader impact as described in multiple sources....

CVE-2022-1061

Radare2 (radare2) vulnerable to a heap-based buffer overflow in the parseDragons function, affecting versions prior to 5.6.8. This issue is described across multiple sources (CVE-2022-1061) and is linked to a commit in the radareorg/radare2 repository (d4ce40b...); upgrading to 5.6.8 or later is ...

CVE-2023-5686

Radare2 (radareorg/radare2) prior to version 5.9.0 contains a heap-based buffer overflow (CVE-2023-5686). The NVD entry confirms the vulnerability in this project; Fedora/Nessus references align with this issue. The available data indicate patching this in 5.9.0 or later as remediation.

CVE-2021-44974

Summary of CVE-2021-44974 : radare2 (radareorg) version 5.5.2 is vulnerable to a NULL Pointer Dereference in the binary symbol parser (libr/bin/p/bin_symbols.c). This can lead to a denial of service, affecting availability. The issue is documented across multiple sources, with a known remediation...

CVE-2022-0523

Radare2 (radareorg/radare2) is affected by CVE-2022-0523 due to a Use After Free vulnerability in versions prior to 5.6.2. The issue is confirmed in multiple security feeds with remediation already tracked in package updates (e.g., radare2 5.6.4). There are no exploit details provided in the sour...

CVE-2022-1383

CVE-2022-1383 affects radare2 (GitHub: radareorg/radare2) prior to 5.6.8. The vulnerability is a heap-based buffer overflow where the program reads data past the end of the intended buffer, potentially allowing access to memory content or a crash. No exploitation details are provided in the suppl...

CVE-2022-1283

CVE-2022-1283 affects radare2 up to version 5.6.8. The issue is a NULL pointer dereference in r_bin_ne_get_entrypoints, leading to a denial of service (application crash). The concrete fix indicated by sources is upgrading to 5.6.8 or later; no exploitation details are provided in the documents. ...

CVE-2022-1296

CVE-2022-1296 affects radare2 (radareorg/radare2) prior to version 5.6.8. The vulnerability is an out-of-bounds read in the r_bin_ne_get_relocs function, which may allow reading sensitive data or cause a crash. Multiple feeds (NVD, CNVD, OSV, Debian/OpenSUSE Alpine trackers) corroborate the same ...

CVE-2022-1451

CVE-2022-1451 refers to an out-of-bounds read in the function r_bin_java_constant_value_attr_new of radare2, prior to version 5.7.0. The issue allows reading past the end of the allocated buffer, potentially exposing sensitive memory content or causing a crash. The description (and multiple conne...

CVE-2023-46569

CVE-2023-46569 affects radare2 v5.8.9 and earlier, with an out-of-bounds read in print_insn32_fpu (libr/arch/p/nds32/nds32-dis.h). The published data indicate a high-severity impact (C:H/I:H/A:H) and a CVSSv3.1 score of 9.8. Connected documents corroborate affected versions and the exact function...

CVE-2022-1207

CVE-2022-1207 (radare2) has concrete technical details in the connected documents: an out-of-bounds read in radare2 prior to v5.6.8. The issue arises when a buffer is allocated with size bb->size and data is read into buf; later, pos = opaddr - bb->addr is added to the pointer before callin...

CVE-2022-0139

CVE-2022-0139 : Use After Free in the radare2 project (radareorg/radare2) prior to version 5.6.0. The entry indicates a memory-use-after-free condition affecting radare2 before 5.6.0; remediation is to upgrade to 5.6.0 or later. All concrete details come from the CVE description; no additional ex...

CVE-2022-0559

CVE-2022-0559 affects the radare2 project (radareorg/radare2) prior to version 5.6.2, with the issue described as a Use After Free in the project’s codebase. The vulnerability is evidenced by the NVD metrics showing a high-severity (base CVSSv3.1 score 9.8, CRITICAL) on network attack with no use...

CVE-2022-1240

CVE-2022-1240 affects radare2 prior to 5.8.6. The vulnerability is a heap buffer overflow in libr/bin/format/mach0/mach0.c, with the issue occurring when address sanitizer is disabled during compilation, potentially leading to exploitation via the r_str_ncpy path. Public documents explicitly desc...

CVE-2022-1284

CVE-2022-1284 affects radare2 prior to version 5.6.8 and is caused by a heap-use-after-free in the codebase, leading to a denial of service. The connected sources (NVD/NVD-derived listings and multiple vendor/security trackers) consistently describe the same flaw and impact. Public details in the...

CVE-2022-1297

CVE-2022-1297 affects radare2 prior to version 5.6.8, where an out-of-bounds read in the r_bin_ne_get_entrypoints function can allow reading sensitive information or cause a crash. The vulnerability is tied to the binary analysis component of radare2; impact includes potential information disclos...

CVE-2021-3673

CVE-2021-3673 affects Radare2, with version 5.3.1 vulnerable to resource exhaustion/DoS due to improper input validation when reading a crafted LE binary. CVSS v3.1 base score 7.5 ( NETWORK attack, LOW complexity, NONE privileges, Availability impact HIGH ). Public details in the initial document...

CVE-2022-1052

CVE-2022-1052 : A heap buffer overflow exists in radare2’s iterate_chained_fixups, affecting versions prior to 5.6.6. The issue is confirmed in multiple sources referencing the same root cause, with CVSS metrics indicating limited local access and potential high impact on availability (CVSS3.1: 5...

CVE-2022-1244

CVE-2022-1244 describes a heap-buffer-overflow in the radare2 project (radareorg/radare2) affecting versions prior to 5.6.8. The underlying issue is a heap buffer overflow in the code path used by radare2, with the documented impact being a denial of service. The available connected sources consi...

CVE-2022-1649

CVE-2022-1649 concerns a null pointer dereference in libr/bin/format/mach0/mach0.c of radare2 (radareorg/radare2) prior to 5.7.0. Multiple connected sources confirm this is a vulnerability in the Mach-O format parser and describe it as exploitable in the sense of dereference-related issues; CVSS ...

CVE-2022-1714

The CVE-2022-1714 issue affects radare2 (radareorg/radare2) prior to 5.7.0 and is caused by an out-of-bounds read that allows reading data beyond the intended buffer, potentially exposing sensitive memory contents or causing a crash. Multiple sources corroborate the same description, and OSV indi...

CVE-2018-20460

radare2 (up to version 3.1.2) is affected by CVE-2018-20460 due to a vulnerability in parseOperands (libr/asm/arch/arm/armass64.c) that can cause a denial-of-service via a crafted input file (stack-based buffer overflow). Public reports across multiple sources confirm the issue; Fedora advisories...

CVE-2022-0849

CVE-2022-0849 describes a Use-After-Free in r_reg_get_name_idx within radare2 before 5.6.6. The affected software is the radare2 project (radareorg/radare2); the vulnerable function is r_reg_get_name_idx. The core issue is a use-after-free on certain code paths, leading to potential memory safety...

CVE-2022-1809

This CVE refers to radare2 (GitHub radareorg/radare2) with an uninitialized pointer issue reported for versions prior to 5.7.0. The vulnerability is described as an access of an uninitialized pointer in radare2 before 5.7.0, indicating potential instability or crashes when triggering the flaw. Th...

CVE-2025-1744

CVE-2025-1744 (radare2) describes an out-of-bounds write vulnerability in radare2 (radareorg) that can cause a heap-based buffer over-read or buffer overflow. Affected version range is radare2 before 5.9.9. The description and references indicate a critical impact (CVSS 3.1/4.0 family) with high ...

CVE-2022-0521

Radare2 (radare2) up to version 5.6.2 contains a memory bounds vulnerability (CVE-2022-0521) caused by an out-of-bounds read/write in buffer handling, leading to a crash/DoS potential. Public notes in multiple advisories (CNVD/CNVD-2022-13394; Debian/Alpine/Fedora trackers; Nessus/Huntr reference...

CVE-2022-1382

CVE-2022-1382: In radare2, a NULL Pointer Dereference in code prior to 5.6.8 can cause the tool to crash, affecting availability. Affected component: radare2 (GitHub: radareorg/radare2). Root cause: NULL pointer dereference leading to crash. Impact: availability disruption of the radare2 service/...

CVE-2022-1238

CVE-2022-1238 affects radare2 prior to 5.6.8, due to an out-of-bounds write in libr/bin/format/ne/ne.c that leads to a heap overflow. The issue is described across multiple sources as a memory boundary validation failure in that component. Affected software is radare2; the vulnerable code path is...

CVE-2022-0173

CVE-2022-0173 refers to an Out-of-bounds Read in radare2. Multiple external sources (e.g., CNVD/CVELIST/Fedora/Mageia/Debian/Nessus references) confirm radare2 as the affected component and describe the vulnerability as a boundary validation issue in memory operations. Reported impact ranges from...

CVE-2022-0419

CVE-2022-0419 affects radare2 up to version 5.6.0, where a NULL pointer dereference in the project’s code path (reported in related advisories) can trigger a crash. The vulnerability is tied to the radare2 repository (radareorg/radare2) prior to 5.6.0; several connected advisories reference null-...

CVE-2021-44975

CVE-2021-44975 affects radare2 (v5.5.2) with a buffer overflow in the Mach-O parser path /libr/core/anal_objc.c. Public descriptions consistently state that radare2 5.5.2 is vulnerable to a boundary/overflow condition, leading to a possible denial of service. Multiple connected sources corroborat...

CVE-2022-0519

CVE-2022-0519 affects the radare2 project (radareorg/radare2) and is described as a Buffer Access with Incorrect Length Value in versions prior to 5.6.2. Public sources in connected documents consistently reference radare2 with this fixed window (e.g., Alpine and Fedora advisories noting updates ...

CVE-2022-1237

CVE-2022-1237 affects radare2 (radareorg/radare2) prior to 5.6.8. The issue is an improper validation of an array index, resulting in a heap overflow. The reports describe this as potentially exploitable, with impact on confidentiality, integrity, and availability. Remediation: upgrade to radare2...

CVE-2022-1452

radare2 (radareorg/radare2)

CVE-2019-12802

CVE-2019-12802 affects radare2 up to 3.5.1, where rcc_context in libr/egg/egg_lang.c mishandles context switching, enabling remote denial of service (crash) and potential other impacts (invalid memory access and free). Public advisories confirm fixes: Fedora updates radare2 to 3.6.0 (and cutter) ...

CVE-2020-27793

CVE-2020-27793 concerns radare2, due to an off-by-one overflow from a mismatched array length in core_java.c. The flaw can cause a crash and enable a denial-of-service condition. The NVD entry lists a CVSSv3.1 base score of 7.5 ( HIGH ) with network attack vector, low complexity, no privileges re...

CVE-2022-1444

CVE-2022-1444 affects radare2 prior to 5.7.0, with a heap-use-after-free in the codebase that can lead to denial of service. Affected software: radare2 (GitHub: radareorg/radare2). Root cause: heap-use-after-free vulnerability described in multiple sources; impact: availability degradation (DoS)....

CVE-2021-4021

Radare2 is affected. CVE-2021-4021 targets Radare2 versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. The vulnerability arises from mapping a large section filled with zeros of an ELF64 binary for the MIPS architecture, which can cause uncontrolled resource consumption and denial of service. Connec...

CVE-2022-0522

CVE-2022-0522 concerns radare2/radare2.js: prior to 5.6.2, the NPM package allows access of memory location before the start of a buffer. Connected sources confirm this vulnerability is tied to radare2.js code paths and have led to vendor advisories and patch releases (e.g., radare2 5.6.4 and rel...