CVE-2019-14745

Radare2 CVE-2019-14745 is a command-injection flaw in bin_symbols() (libr/core/cbin.c) present in versions before 3.7.0, due to improper handling of symbol names embedded in executables. By feeding a crafted binary, an attacker could execute arbitrary shell commands with the victim’s privileges. ...

CVE-2022-0713

CVE-2022-0713 describes a heap-based buffer overflow in the radare2 project (GitHub: radareorg/radare2) prior to version 5.6.4. The vulnerability arises from a heap overflow in the software’s handling of input via its radare2 components, with reported impacts consistent with a high-severity local...

CVE-2022-0476

CVE-2022-0476 affects radare2 prior to 5.6.4, with a documented Denial of Service in the GitHub repository radareorg/radare2. Multiple sources (NVD entry and vendor advisories) confirm the issue impacts versions before 5.6.4 and note that patches released as part of radare2 5.6.4 mitigate the vul...

CVE-2022-0676

CVE-2022-0676 corresponds to a heap-based buffer overflow in radare2 (radareorg/radare2) prior to version 5.6.4. The connected entries consistently describe a vulnerability in the radare2 codebase that is triggered by handling crafted inputs, leading to heap overflow. Affected products/packaged d...

CVE-2022-0518

CVE-2022-0518 covers a heap-based buffer overflow in radare2 (radareorg/radare2) prior to 5.6.2. Connected sources corroborate the issue across multiple OS packages and advisories, with references to an upstream fix trajectory (e.g., later distro updates such as radare2 5.6.x series). Public deta...

CVE-2022-0695

CVE-2022-0695 affects radare2 (GitHub radareorg/radare2). The vulnerability is a Denial of Service in versions prior to 5.6.4, caused by a bug in the code path that leads to resource exhaustion. Public sources in the connected documents indicate a DoS impact and reference the patch release throug...

CVE-2023-0302

Technical details (affected components, exact impact, exploitation) are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

CVE-2022-0712

CVE-2022-0712: NULL Pointer Dereference in radare2 (radareorg/radare2) prior to 5.6.4. The issue affects the radare2 project and can impact availability (CVSSv3.1: A=High) with local access requirements. The patched version is 5.6.4 ( Fedora updates and vendor advisories confirm remediation). Oth...

CVE-2022-1031

CVE-2022-1031 affects radare2 (radareorg/radare2) prior to version 5.6.6, due to a use-after-free in the op_is_set_bp path. The vulnerability resides in the memory management of that directive, enabling memory corruption that can lead to a crash or broader impact as described in multiple sources....

CVE-2022-1061

Radare2 (radare2) vulnerable to a heap-based buffer overflow in the parseDragons function, affecting versions prior to 5.6.8. This issue is described across multiple sources (CVE-2022-1061) and is linked to a commit in the radareorg/radare2 repository (d4ce40b...); upgrading to 5.6.8 or later is ...

CVE-2023-5686

Radare2 (radareorg/radare2) prior to version 5.9.0 contains a heap-based buffer overflow (CVE-2023-5686). The NVD entry confirms the vulnerability in this project; Fedora/Nessus references align with this issue. The available data indicate patching this in 5.9.0 or later as remediation.

CVE-2021-44974

Summary of CVE-2021-44974 : radare2 (radareorg) version 5.5.2 is vulnerable to a NULL Pointer Dereference in the binary symbol parser (libr/bin/p/bin_symbols.c). This can lead to a denial of service, affecting availability. The issue is documented across multiple sources, with a known remediation...

CVE-2022-0523

Radare2 (radareorg/radare2) is affected by CVE-2022-0523 due to a Use After Free vulnerability in versions prior to 5.6.2. The issue is confirmed in multiple security feeds with remediation already tracked in package updates (e.g., radare2 5.6.4). There are no exploit details provided in the sour...

CVE-2022-1383

CVE-2022-1383 affects radare2 (GitHub: radareorg/radare2) prior to 5.6.8. The vulnerability is a heap-based buffer overflow where the program reads data past the end of the intended buffer, potentially allowing access to memory content or a crash. No exploitation details are provided in the suppl...

CVE-2022-1283

CVE-2022-1283 affects radare2 up to version 5.6.8. The issue is a NULL pointer dereference in r_bin_ne_get_entrypoints, leading to a denial of service (application crash). The concrete fix indicated by sources is upgrading to 5.6.8 or later; no exploitation details are provided in the documents. ...

CVE-2022-0139

CVE-2022-0139 : Use After Free in the radare2 project (radareorg/radare2) prior to version 5.6.0. The entry indicates a memory-use-after-free condition affecting radare2 before 5.6.0; remediation is to upgrade to 5.6.0 or later. All concrete details come from the CVE description; no additional ex...

CVE-2022-0559

CVE-2022-0559 affects the radare2 project (radareorg/radare2) prior to version 5.6.2, with the issue described as a Use After Free in the project’s codebase. The vulnerability is evidenced by the NVD metrics showing a high-severity (base CVSSv3.1 score 9.8, CRITICAL) on network attack with no use...

CVE-2022-1296

CVE-2022-1296 affects radare2 (radareorg/radare2) prior to version 5.6.8. The vulnerability is an out-of-bounds read in the r_bin_ne_get_relocs function, which may allow reading sensitive data or cause a crash. Multiple feeds (NVD, CNVD, OSV, Debian/OpenSUSE Alpine trackers) corroborate the same ...

CVE-2022-1451

CVE-2022-1451 refers to an out-of-bounds read in the function r_bin_java_constant_value_attr_new of radare2, prior to version 5.7.0. The issue allows reading past the end of the allocated buffer, potentially exposing sensitive memory content or causing a crash. The description (and multiple conne...

CVE-2023-46569

CVE-2023-46569 affects radare2 v5.8.9 and earlier, with an out-of-bounds read in print_insn32_fpu (libr/arch/p/nds32/nds32-dis.h). The published data indicate a high-severity impact (C:H/I:H/A:H) and a CVSSv3.1 score of 9.8. Connected documents corroborate affected versions and the exact function...

CVE-2022-1207

CVE-2022-1207 (radare2) has concrete technical details in the connected documents: an out-of-bounds read in radare2 prior to v5.6.8. The issue arises when a buffer is allocated with size bb->size and data is read into buf; later, pos = opaddr - bb->addr is added to the pointer before callin...

CVE-2022-1714

The CVE-2022-1714 issue affects radare2 (radareorg/radare2) prior to 5.7.0 and is caused by an out-of-bounds read that allows reading data beyond the intended buffer, potentially exposing sensitive memory contents or causing a crash. Multiple sources corroborate the same description, and OSV indi...

CVE-2022-1052

CVE-2022-1052 : A heap buffer overflow exists in radare2’s iterate_chained_fixups, affecting versions prior to 5.6.6. The issue is confirmed in multiple sources referencing the same root cause, with CVSS metrics indicating limited local access and potential high impact on availability (CVSS3.1: 5...

CVE-2022-1284

CVE-2022-1284 affects radare2 prior to version 5.6.8 and is caused by a heap-use-after-free in the codebase, leading to a denial of service. The connected sources (NVD/NVD-derived listings and multiple vendor/security trackers) consistently describe the same flaw and impact. Public details in the...

CVE-2022-1297

CVE-2022-1297 affects radare2 prior to version 5.6.8, where an out-of-bounds read in the r_bin_ne_get_entrypoints function can allow reading sensitive information or cause a crash. The vulnerability is tied to the binary analysis component of radare2; impact includes potential information disclos...

CVE-2022-0849

CVE-2022-0849 describes a Use-After-Free in r_reg_get_name_idx within radare2 before 5.6.6. The affected software is the radare2 project (radareorg/radare2); the vulnerable function is r_reg_get_name_idx. The core issue is a use-after-free on certain code paths, leading to potential memory safety...

CVE-2022-1244

CVE-2022-1244 describes a heap-buffer-overflow in the radare2 project (radareorg/radare2) affecting versions prior to 5.6.8. The underlying issue is a heap buffer overflow in the code path used by radare2, with the documented impact being a denial of service. The available connected sources consi...

CVE-2022-1649

CVE-2022-1649 concerns a null pointer dereference in libr/bin/format/mach0/mach0.c of radare2 (radareorg/radare2) prior to 5.7.0. Multiple connected sources confirm this is a vulnerability in the Mach-O format parser and describe it as exploitable in the sense of dereference-related issues; CVSS ...

CVE-2018-20460

radare2 (up to version 3.1.2) is affected by CVE-2018-20460 due to a vulnerability in parseOperands (libr/asm/arch/arm/armass64.c) that can cause a denial-of-service via a crafted input file (stack-based buffer overflow). Public reports across multiple sources confirm the issue; Fedora advisories...

CVE-2022-1809

This CVE refers to radare2 (GitHub radareorg/radare2) with an uninitialized pointer issue reported for versions prior to 5.7.0. The vulnerability is described as an access of an uninitialized pointer in radare2 before 5.7.0, indicating potential instability or crashes when triggering the flaw. Th...

CVE-2022-1238

CVE-2022-1238 affects radare2 prior to 5.6.8, due to an out-of-bounds write in libr/bin/format/ne/ne.c that leads to a heap overflow. The issue is described across multiple sources as a memory boundary validation failure in that component. Affected software is radare2; the vulnerable code path is...

CVE-2022-0173

CVE-2022-0173 refers to an Out-of-bounds Read in radare2. Multiple external sources (e.g., CNVD/CVELIST/Fedora/Mageia/Debian/Nessus references) confirm radare2 as the affected component and describe the vulnerability as a boundary validation issue in memory operations. Reported impact ranges from...

CVE-2022-1382

CVE-2022-1382: In radare2, a NULL Pointer Dereference in code prior to 5.6.8 can cause the tool to crash, affecting availability. Affected component: radare2 (GitHub: radareorg/radare2). Root cause: NULL pointer dereference leading to crash. Impact: availability disruption of the radare2 service/...

CVE-2022-0521

Radare2 (radare2) up to version 5.6.2 contains a memory bounds vulnerability (CVE-2022-0521) caused by an out-of-bounds read/write in buffer handling, leading to a crash/DoS potential. Public notes in multiple advisories (CNVD/CNVD-2022-13394; Debian/Alpine/Fedora trackers; Nessus/Huntr reference...

CVE-2022-0419

CVE-2022-0419 affects radare2 up to version 5.6.0, where a NULL pointer dereference in the project’s code path (reported in related advisories) can trigger a crash. The vulnerability is tied to the radare2 repository (radareorg/radare2) prior to 5.6.0; several connected advisories reference null-...

CVE-2022-0522

CVE-2022-0522 concerns radare2/radare2.js: prior to 5.6.2, the NPM package allows access of memory location before the start of a buffer. Connected sources confirm this vulnerability is tied to radare2.js code paths and have led to vendor advisories and patch releases (e.g., radare2 5.6.4 and rel...

CVE-2022-1452

radare2 (radareorg/radare2)

CVE-2020-27793

CVE-2020-27793 concerns radare2, due to an off-by-one overflow from a mismatched array length in core_java.c. The flaw can cause a crash and enable a denial-of-service condition. The NVD entry lists a CVSSv3.1 base score of 7.5 ( HIGH ) with network attack vector, low complexity, no privileges re...

CVE-2022-0519

CVE-2022-0519 affects the radare2 project (radareorg/radare2) and is described as a Buffer Access with Incorrect Length Value in versions prior to 5.6.2. Public sources in connected documents consistently reference radare2 with this fixed window (e.g., Alpine and Fedora advisories noting updates ...

CVE-2022-1237

CVE-2022-1237 affects radare2 (radareorg/radare2) prior to 5.6.8. The issue is an improper validation of an array index, resulting in a heap overflow. The reports describe this as potentially exploitable, with impact on confidentiality, integrity, and availability. Remediation: upgrade to radare2...

CVE-2022-1444

CVE-2022-1444 affects radare2 prior to 5.7.0, with a heap-use-after-free in the codebase that can lead to denial of service. Affected software: radare2 (GitHub: radareorg/radare2). Root cause: heap-use-after-free vulnerability described in multiple sources; impact: availability degradation (DoS)....

CVE-2020-27794

The CVE-2020-27794 entry concerns radare2, specifically a vulnerability in cmd_info.c:cmd_info() where a double free could corrupt memory and potentially crash the process. The affected software/component is radare2 (cmd_info.c function). The root cause is a double free in the handling of informa...

CVE-2022-4398

CVE-2022-4398 affects radare2 (radareorg/radare2) prior to 5.8.0. The issue is described as an Integer Overflow or Wraparound in the project, with the vulnerability path not explicitly detailed in the provided documents. The available sources indicate a fix was released in version 5.8.0 (upgrade ...

CVE-2020-27795

CVE-2020-27795 describes a segmentation fault in radare2 triggered by the adf command when it has no or invalid arguments. The fault arises in libr/core/cmd_anal.c: anal_fcn_data(core, input+1) calls r_anal_get_fcn_in(core->anal, core->offset, -1) and receives a null fcn, which then leads t...

CVE-2022-0520

CVE-2022-0520 is a Use After Free vulnerability in the radare2.js module for NPM, prior to version 5.6.2. The issue affects radare2.js code paths handling memory and can lead to instability or potential exploitation. Affected product/component: radare2.js (NPM) with Radare2 framework. Root cause:...

CVE-2022-1437

CVE-2022-1437 is a heap-based buffer overflow in radare2 (radareorg/radare2) prior to version 5.7.0. The vulnerability causes reads beyond the intended buffer, which can allow reading sensitive memory content or trigger a crash. Exploitation details are not provided in the supplied documents. Ope...

CVE-2023-1605

CVE-2023-1605 affects radare2 (radareorg/radare2) prior to 5.8.6, with Denial of Service as the impact. The provided documents confirm exploitation is not detailed and do not provide exact root cause, but remediation is available: radare2 5.8.6 (openSUSE GA package radare2-5.8.6-1.1) includes fix...

CVE-2020-15121

CVE-2020-15121 affects radare2 prior to version 4.5.0. Malformed PDB file names in the PDB server path enable a shell injection when a user opens an executable in radare2 and runs idpd to trigger the download; the shell code can run and create a file named pwned in the current directory. Remediat...

CVE-2022-1899

Technical details about CVE-2022-1899 are not publicly provided in the supplied documents; only the general description of an out-of-bounds read in radare2 before 5.7.0 is given. Monitor for updates.

CVE-2018-20456

Radare2 before 3.1.1 is affected by a vulnerability in parseOperand inside libr/asm/p/asm_x86_nz.c, which can cause a denial of service (application crash via stack-based buffer over-read/overflow) when processing a crafted input file. The issue stems from the parseOperand implementation and resu...