Radare Radare2 vulnerabilities

CVE-2020-17487 [HIGH] CVE-2020-17487: radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_pa radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY.

CVE-2022-1238 [HIGH] CWE-787 CVE-2022-1238: Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8 Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVE-2022-1237 [HIGH] CWE-129 CVE-2022-1237: Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulne Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVE-2020-27795 [HIGH] CWE-908 CVE-2020-27795: A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when comma A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).

CVE-2023-47016 [HIGH] CWE-787 CVE-2023-47016: radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a cras radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

CVE-2024-29645 [HIGH] CWE-120 CVE-2024-29645: Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary co Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function.

CVE-2022-28069 [HIGH] CWE-787 CVE-2022-28069: A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0. A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.

CVE-2022-1240 [HIGH] CWE-122 CVE-2022-1240: Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior t Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.

CVE-2017-10929 [HIGH] CWE-119 CVE-2017-10929: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB 2.02.

CVE-2022-0676 [HIGH] CWE-122 CVE-2022-0676: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.

CVE-2019-12829 [HIGH] CWE-787 CVE-2019-12829: radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c.

CVE-2022-28070 [HIGH] CWE-476 CVE-2022-28070: A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0. A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.

CVE-2022-4843 [HIGH] CWE-476 CVE-2022-4843: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2. NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.

CVE-2026-6940 [HIGH] CWE-22 CVE-2026-6940: radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive de

CVE-2017-6194 [HIGH] CWE-119 CVE-2017-6194: The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a den The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

CVE-2017-6448 [HIGH] CWE-119 CVE-2017-6448: The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

CVE-2019-12790 [HIGH] CWE-125 CVE-2019-12790: In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar functio In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.

CVE-2019-19647 [HIGH] CWE-476 CVE-2019-19647: radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin a radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.

CVE-2022-0523 [HIGH] CWE-416 CVE-2022-0523: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

CVE-2017-16357 [HIGH] CWE-119 CVE-2017-16357: In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and stor In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.