EUVD-2026-41768
GHSA-f973-xj97-7vpp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low-privilege execution of radare2; impact limited to process crash, no confidentiality or integrity loss confirmed.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
AnalysisAI
Integer overflow in radare2's hexpairs parser crashes the process for local low-privilege users on versions up to 6.1.6. The flaw exists in the cmd_anal_opcode function within libr/core/cmd_anal.inc.c and produces only a low availability impact with no confidentiality or integrity consequences. Publicly available exploit code exists, but the local-only attack vector and trivial impact class make this a low-priority finding for most deployments. No active exploitation has been confirmed and this vulnerability is not listed in CISA KEV.
Technical ContextAI
radare2 is an open-source reverse engineering and binary analysis framework. The vulnerable code path is the hexpairs parser inside cmd_anal_opcode in libr/core/cmd_anal.inc.c - the component responsible for interpreting hex-encoded byte-pair sequences used in disassembly and analysis commands. CWE-189 (Numeric Errors) covers integer overflow conditions where arithmetic on a bounded integer type wraps or truncates, producing an out-of-range value that can misalign memory operations such as buffer length calculations. The reporter's supplemental tag 'Buffer Overflow' suggests the integer overflow may secondarily mis-size a buffer allocation or index, though the confirmed impact is limited to a process crash rather than arbitrary code execution. No CPE strings were supplied in the input data.
RemediationAI
Apply the upstream fix commit 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 available at https://github.com/radareorg/radare2/commit/84e773986e7e5bb30453a9384f498ec0ccc9d0a9. An exact released patched version number was not independently confirmed from available data - users should monitor the radare2 GitHub releases page for a tagged version that includes this commit, or build directly from the patched commit. As a compensating control in multi-user environments, restrict which local users have permission to execute radare2, or prevent execution against untrusted hexpairs input via command access policies. The trade-off of this workaround is reduced utility of radare2 in shared analyst environments.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-189 – Numeric Errors
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today