Radare Radare2 vulnerabilities

CVE-2026-81886 [MEDIUM] CWE-770 CVE-2026-81886: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small c

CVE-2017-7274 [MEDIUM] CWE-476 CVE-2017-7274: The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to ca The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PE file.

CVE-2018-8809 [MEDIUM] CWE-125 CVE-2018-8809: In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.

CVE-2017-16359 [MEDIUM] CWE-476 CVE-2017-16359: In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.

CVE-2018-20455 [MEDIUM] CWE-787 CVE-2018-20455: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attack In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.

CVE-2018-10187 [MEDIUM] CWE-125 CVE-2018-10187: In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. Note that this issue is different from CVE-2018-8809, which was patched earlier.

CVE-2022-1244 [MEDIUM] CWE-122 CVE-2022-1244: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is ca heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

CVE-2022-1444 [MEDIUM] CWE-416 CVE-2022-1444: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is cap heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.

CVE-2022-1284 [MEDIUM] CWE-416 CVE-2022-1284: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is cap heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

CVE-2022-34502 [MEDIUM] CWE-787 CVE-2022-34502: Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_nam Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.

CVE-2026-81881 [MEDIUM] CWE-125 CVE-2026-81881: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift typ

CVE-2017-6197 [MEDIUM] CWE-476 CVE-2017-6197: The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by the r_read_le32 function.

CVE-2018-11377 [MEDIUM] CWE-125 CVE-2018-11377: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

CVE-2017-9761 [MEDIUM] CWE-119 CVE-2017-9761: The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

CVE-2018-14015 [MEDIUM] CWE-119 CVE-2018-14015: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.

CVE-2018-14016 [MEDIUM] CWE-125 CVE-2018-14016: The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to c The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file.

CVE-2018-14017 [MEDIUM] CWE-125 CVE-2018-14017: The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new.

CVE-2018-8810 [MEDIUM] CWE-125 CVE-2018-8810: In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_cl In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted Mach-O file.

CVE-2018-8808 [MEDIUM] CWE-125 CVE-2018-8808: In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.

CVE-2018-20460 [MEDIUM] CWE-787 CVE-2018-20460: In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attacke In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.