EUVD-2026-41770
GHSA-mmvx-pw62-p5qq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user account
-
DeliveryLaunch radare2 with crafted input
-
ExploitTrigger r_core_seek_arch_bits in regprofile Handler
-
ExecutionDereference freed memory pointer
-
Impactradare2 process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local access is required (CVSS AV:L); the attacker must be able to execute radare2 on the target system, which requires at minimum a local shell account (CVSS PR:L). The vulnerability is triggered through the regprofile Handler's r_core_seek_arch_bits function - no special non-default configuration of radare2 is indicated as a prerequisite. Exploitation is limited to crashing the radare2 process itself; no privilege escalation, lateral movement, or data exfiltration is possible based on VC:N/VI:N impact metrics. Remote exploitation is not feasible given AV:L. The primary limiting factor for most organizations is that radare2 is a developer/analyst tool not commonly exposed to untrusted local users. |
| Impact | The CVSS 4.0 base score of 4.8 (Medium) reflects constrained real-world impact. The vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N confirms: local access is mandatory, privileges are required (low), and the only impact is a low-severity availability disruption to the vulnerable system itself with no subsequent-system effect. EPSS data was not supplied; however, the local-only attack surface and DoS-only impact substantially limit real-world priority. A public proof-of-concept exists (GitHub issue #26044, exploit tag in references), which elevates the ease of triggering the bug but does not change the bounded impact. The CVE is not listed in CISA KEV, consistent with no confirmed widespread exploitation. This is a low-priority finding outside of environments where radare2 is used in multi-tenant or automated analysis pipelines where a crash constitutes a meaningful service disruption. |
| Exploit ScenarioDerived | A local user with standard account privileges opens a crafted binary or passes a specially constructed input to radare2 that triggers the r_core_seek_arch_bits code path in the regprofile handler. The use-after-free dereferences a freed memory region, causing radare2 to crash. A public proof-of-concept documenting this trigger is referenced in GitHub issue #26044. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Use-after-free in radare2's regprofile handler crashes the application for local users on versions up to 6.1.6. The vulnerable function r_core_seek_arch_bits in libr/core/disasm.c mismanages memory during architecture bit-seeking operations, allowing a local attacker with standard user privileges to trigger application termination. No confidentiality or integrity impact is present; this is a denial-of-service class finding with a publicly available proof-of-concept and no confirmed active exploitation in the wild.
RemediationAI
Apply upstream patch commit 8b25c773785d85cb0103410a0905089d286921c2 available at https://github.com/radareorg/radare2/commit/8b25c773785d85cb0103410a0905089d286921c2. A specific tagged release version incorporating this fix has not been independently confirmed; users should build from a commit at or after 8b25c77 or monitor the radare2 release page for a versioned release that includes it. As a compensating control where patching is not immediately feasible, restrict radare2 execution to trusted users in controlled environments, and avoid running radare2 in automated or service contexts where a crash has service-availability consequences. There are no known side effects to the patch itself based on available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 (CPE: cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*) is an open-source reverse engineering framework. The flaw resides in the regprofile handler within r_core_seek_arch_bits() in libr/core/disasm.c. CWE-416 (Use After Free) describes the root cause: a memory region is freed but a dangling pointer to it is subsequently dereferenced during architecture profile resolution. This class of bug arises from improper lifetime management of objects passed between the seek and disassembly subsystems. Because the impact is limited to VA:L (vulnerable system availability, low), the likely outcome is a crash or abort rather than code execution, consistent with the Denial of Service and Memory Corruption tags.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local access with low privileges is required; impact is confined to application availability (crash), with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB