Radareorg Radare2 vulnerabilities

CVE-2025-1744 [CRITICAL] CWE-787 CVE-2025-1744: Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffe Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9.

CVE-2025-1864 [CRITICAL] CWE-119 CVE-2025-1864: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg r Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9.

CVE-2026-40499 [HIGH] CWE-78 CVE-2026-40499: radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_ radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed wh

CVE-2026-40527 [HIGH] CWE-78 CVE-2026-40527: radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequ

CVE-2026-14789 [HIGH] CWE-119 CVE-2026-14789: A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknow A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The pa

CVE-2020-15121 [CRITICAL] CWE-78 CVE-2020-15121: In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injecti In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.

CVE-2026-40517 [HIGH] CWE-78 CVE-2026-40517: radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command

CVE-2026-14759 [HIGH] CWE-119 CVE-2026-14759: A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the functio A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been relea

CVE-2026-14787 [HIGH] CWE-189 CVE-2026-14787: A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch n

CVE-2026-14788 [HIGH] CWE-119 CVE-2026-14788: A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulner A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c

CVE-2026-6941 [HIGH] CWE-59 CVE-2026-6941: radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that al radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement ch

CVE-2026-14757 [HIGH] CWE-189 CVE-2026-14757: A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.

CVE-2026-14760 [HIGH] CWE-119 CVE-2026-14760: A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_see A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This

CVE-2026-112077 [MEDIUM] CWE-693 CVE-2026-112077: A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_cor A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The attack is considered to have h

CVE-2026-6940 [HIGH] CWE-22 CVE-2026-6940: radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive de

CVE-2026-81882 [MEDIUM] CWE-125 CVE-2026-81882: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB

CVE-2026-81878 [MEDIUM] CWE-190 CVE-2026-81878: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a

CVE-2026-14758 [MEDIUM] CWE-189 CVE-2026-14758: A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the func A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the pat

CVE-2026-14761 [MEDIUM] CWE-189 CVE-2026-14761: A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae8

CVE-2026-81879 [MEDIUM] CWE-125 CVE-2026-81879: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by proces