EUVD-2026-41766
GHSA-m7vh-m7f4-7h43
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local execution of radare2 with low-privilege user access is required; no scope change and symmetric low CIA impact reflect the bounded integer overflow effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.
AnalysisAI
Integer overflow in radare2's binary analysis function exposes local users on systems running version 6.1.6 or earlier to limited confidentiality, integrity, and availability impacts. The flaw resides in the core_anal_bytes function within libr/core/cmd_anal.inc and requires only low-privilege local access to trigger via crafted binary input. A public proof-of-concept exploit has been disclosed, though no confirmed active exploitation (CISA KEV) is recorded; the CVSS 4.0 score of 1.9 reflects the tightly constrained local-only attack surface and limited impact scope.
Technical ContextAI
radare2 is an open-source reverse engineering framework built for binary disassembly, analysis, and debugging, widely used in security research, malware analysis, and CTF competition infrastructure. The vulnerable function core_anal_bytes in libr/core/cmd_anal.inc performs byte-level analysis of binary data streams. CWE-189 (Numeric Errors, encompassing integer overflow) indicates that arithmetic operations within this function do not adequately validate or bound-check integer values prior to use, creating the potential for memory region miscalculation or unexpected control flow. The CVSS 4.0 supplemental metric E:P confirms that a proof-of-concept for this overflow path has been publicly released. No CPE strings were included in the source data; affected versions are identified as up to and including 6.1.6 via NVD and VulDB reporting (vuldb.com/vuln/376346).
RemediationAI
The vendor recommendation is to install the available patch. Users should monitor the upstream GitHub repository at https://github.com/radareorg/radare2 and GitHub issue #26041 (https://github.com/radareorg/radare2/issues/26041) for the patched release version, as an exact fixed version number was not independently confirmed in the provided data - the fix should be treated as 'upstream fix in progress; released patched version not independently confirmed.' As a compensating control until a confirmed patched build is available, restrict radare2 execution to trusted users only in multi-user environments by adjusting file-system permissions on the radare2 binary. In automated analysis pipelines, run radare2 inside a sandboxed container (e.g., a minimal Docker image with dropped capabilities and read-only mounts) to limit the blast radius of any exploitation to the container scope. Network-level mitigations are not applicable given the strictly local attack vector.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-189 – Numeric Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today