Radare Radare2 vulnerabilities

CVE-2022-1244 [MEDIUM] CWE-122 CVE-2022-1244: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is ca heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

CVE-2022-1284 [MEDIUM] CWE-416 CVE-2022-1284: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is cap heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

CVE-2022-1444 [MEDIUM] CWE-416 CVE-2022-1444: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is cap heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.

CVE-2022-1052 [MEDIUM] CWE-122 CVE-2022-1052: Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6 Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.

CVE-2022-34502 [MEDIUM] CWE-787 CVE-2022-34502: Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_nam Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.

CVE-2025-63745 [MEDIUM] CWE-476 CVE-2025-63745: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.

CVE-2025-63744 [MEDIUM] CWE-476 CVE-2025-63744: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.

CVE-2017-6197 [MEDIUM] CWE-476 CVE-2017-6197: The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by the r_read_le32 function.

CVE-2017-9761 [MEDIUM] CWE-119 CVE-2017-9761: The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

CVE-2018-14015 [MEDIUM] CWE-119 CVE-2018-14015: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.

CVE-2018-14016 [MEDIUM] CWE-125 CVE-2018-14016: The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to c The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file.

CVE-2018-14017 [MEDIUM] CWE-125 CVE-2018-14017: The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new.

CVE-2018-8810 [MEDIUM] CWE-125 CVE-2018-8810: In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_cl In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted Mach-O file.

CVE-2018-8809 [MEDIUM] CWE-125 CVE-2018-8809: In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.

CVE-2018-8808 [MEDIUM] CWE-125 CVE-2018-8808: In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.

CVE-2020-16269 [MEDIUM] CVE-2020-16269: radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.

CVE-2018-19842 [MEDIUM] CWE-125 CVE-2018-19842: getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of se getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.

CVE-2018-15834 [MEDIUM] CWE-787 CVE-2018-15834: In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_function In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file.

CVE-2018-20459 [MEDIUM] CVE-2018-20459: In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attacker In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.

CVE-2019-12865 [MEDIUM] CWE-415 CVE-2019-12865: In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command. In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.