Radare Radare2 vulnerabilities

CVE-2020-16269 [MEDIUM] CVE-2020-16269: radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.

CVE-2018-19842 [MEDIUM] CWE-125 CVE-2018-19842: getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of se getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.

CVE-2018-15834 [MEDIUM] CWE-787 CVE-2018-15834: In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_function In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file.

CVE-2018-20459 [MEDIUM] CVE-2018-20459: In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attacker In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.

CVE-2019-12865 [MEDIUM] CWE-415 CVE-2019-12865: In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command. In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.

CVE-2021-44974 [MEDIUM] CWE-476 CVE-2021-44974: radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

CVE-2018-10186 [MEDIUM] CVE-2018-10186: In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/he In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368.

CVE-2018-20457 [MEDIUM] CWE-125 CVE-2018-20457: In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to c In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-

CVE-2018-12322 [MEDIUM] CWE-125 CVE-2018-12322: There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a c There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.

CVE-2022-1382 [MEDIUM] CWE-476 CVE-2022-1382: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability i NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.

CVE-2022-0849 [MEDIUM] CWE-416 CVE-2022-0849: Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6. Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.

CVE-2022-1052 [MEDIUM] CWE-122 CVE-2022-1052: Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6 Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.

CVE-2025-63745 [MEDIUM] CWE-476 CVE-2025-63745: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.

CVE-2025-63744 [MEDIUM] CWE-476 CVE-2025-63744: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.

CVE-2017-6415 [MEDIUM] CWE-476 CVE-2017-6415: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers t The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.

CVE-2017-7854 [MEDIUM] CWE-125 CVE-2017-7854: The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.

CVE-2017-6387 [MEDIUM] CWE-125 CVE-2017-6387: The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.

CVE-2018-20456 [MEDIUM] CVE-2018-20456: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attack In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.

CVE-2018-19843 [MEDIUM] CWE-125 CVE-2018-19843: opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of servi opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.

CVE-2022-0695 [MEDIUM] CWE-400 CVE-2022-0695: Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.