EUVD-2026-41770
GHSA-mmvx-pw62-p5qq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges is required; impact is confined to application availability (crash), with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
AnalysisAI
Use-after-free in radare2's regprofile handler crashes the application for local users on versions up to 6.1.6. The vulnerable function r_core_seek_arch_bits in libr/core/disasm.c mismanages memory during architecture bit-seeking operations, allowing a local attacker with standard user privileges to trigger application termination. No confidentiality or integrity impact is present; this is a denial-of-service class finding with a publicly available proof-of-concept and no confirmed active exploitation in the wild.
Technical ContextAI
radare2 (CPE: cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*) is an open-source reverse engineering framework. The flaw resides in the regprofile handler within r_core_seek_arch_bits() in libr/core/disasm.c. CWE-416 (Use After Free) describes the root cause: a memory region is freed but a dangling pointer to it is subsequently dereferenced during architecture profile resolution. This class of bug arises from improper lifetime management of objects passed between the seek and disassembly subsystems. Because the impact is limited to VA:L (vulnerable system availability, low), the likely outcome is a crash or abort rather than code execution, consistent with the Denial of Service and Memory Corruption tags.
RemediationAI
Apply upstream patch commit 8b25c773785d85cb0103410a0905089d286921c2 available at https://github.com/radareorg/radare2/commit/8b25c773785d85cb0103410a0905089d286921c2. A specific tagged release version incorporating this fix has not been independently confirmed; users should build from a commit at or after 8b25c77 or monitor the radare2 release page for a versioned release that includes it. As a compensating control where patching is not immediately feasible, restrict radare2 execution to trusted users in controlled environments, and avoid running radare2 in automated or service contexts where a crash has service-availability consequences. There are no known side effects to the patch itself based on available data.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today