EUVD-2026-41768
GHSA-f973-xj97-7vpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege system access
-
ExploitInvoke radare2 with crafted hexpairs input
-
ExecutionTrigger integer overflow in cmd_anal_opcode parser
-
ImpactCrash radare2 process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric handling
|
| Exploitation Conditions | Exploitation requires a local account with at minimum low-privilege access on the host running radare2 - remote exploitation is not possible per the CVSS 4.0 AV:L vector. The attacker must be able to invoke radare2 and supply crafted input to the hexpairs parser through the |
| Impact | The CVSS 4.0 score of 1.9 accurately reflects a very low-severity finding. All key risk signals align: attack vector is strictly local (AV:L), requiring the ability to run radare2 on the host; privileges required are low (PR:L); and the only impact is low availability (VA:L), meaning a process crash with no confidentiality or integrity consequences. EPSS data was not provided, and this vulnerability does not appear in CISA KEV, confirming no known active exploitation. The availability of public exploit code (per the description) marginally elevates theoretical risk but does not change the exploitability class given the local-only vector. This is best characterized as a stability/robustness issue rather than a security priority for most organizations. Elevated concern exists only in multi-user environments where untrusted local users can invoke radare2 to analyze files. |
| Exploit ScenarioDerived | A local user with low-privilege access invokes radare2 and supplies a specially crafted hexpairs string to the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Integer overflow in radare2's hexpairs parser crashes the process for local low-privilege users on versions up to 6.1.6. The flaw exists in the cmd_anal_opcode function within libr/core/cmd_anal.inc.c and produces only a low availability impact with no confidentiality or integrity consequences. Publicly available exploit code exists, but the local-only attack vector and trivial impact class make this a low-priority finding for most deployments. No active exploitation has been confirmed and this vulnerability is not listed in CISA KEV.
RemediationAI
Apply the upstream fix commit 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 available at https://github.com/radareorg/radare2/commit/84e773986e7e5bb30453a9384f498ec0ccc9d0a9. An exact released patched version number was not independently confirmed from available data - users should monitor the radare2 GitHub releases page for a tagged version that includes this commit, or build directly from the patched commit. As a compensating control in multi-user environments, restrict which local users have permission to execute radare2, or prevent execution against untrusted hexpairs input via command access policies. The trade-off of this workaround is reduced utility of radare2 in shared analyst environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 is an open-source reverse engineering and binary analysis framework. The vulnerable code path is the hexpairs parser inside cmd_anal_opcode in libr/core/cmd_anal.inc.c - the component responsible for interpreting hex-encoded byte-pair sequences used in disassembly and analysis commands. CWE-189 (Numeric Errors) covers integer overflow conditions where arithmetic on a bounded integer type wraps or truncates, producing an out-of-range value that can misalign memory operations such as buffer length calculations. The reporter's supplemental tag 'Buffer Overflow' suggests the integer overflow may secondarily mis-size a buffer allocation or index, though the confirmed impact is limited to a process crash rather than arbitrary code execution. No CPE strings were supplied in the input data.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local-only attack requiring low-privilege execution of radare2; impact limited to process crash, no confidentiality or integrity loss confirmed.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB