EUVD-2026-41771
GHSA-q4m4-82h9-qfgv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege shell access
-
DeliverySupply crafted input to radare2
-
ExploitTrigger integer overflow in r_str_ndup or r_str_append
-
ExecutionCause incorrect memory size allocation
-
ImpactCrash radare2 process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric handling
|
| Exploitation Conditions | Exploitation requires local access to a system where radare2 is installed, with at least low-privilege execution rights (PR:L per CVSS 4.0). The attacker must be able to invoke radare2 or a process that calls the affected string utility functions with attacker-influenced input. No network exposure is involved (AV:L). No special non-default configuration is required (AC:L/AT:N), meaning any standard radare2 installation on an affected version is susceptible when a local user exercises the vulnerable code path. Exploitation is bounded by the local-only attack surface; remote or unauthenticated exploitation is not applicable to this vulnerability. |
| Impact | The overall risk is very low. The CVSS 4.0 base score is 1.9, reflecting a local-only attack vector (AV:L), low-privilege requirement (PR:L), no complexity or attack-target prerequisites (AC:L/AT:N), and only partial availability impact on the vulnerable system (VA:L). No subsequent-system impact is assessed (SC:N/SI:N/SA:N). EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. However, the E:P supplemental metric confirms public exploit code exists, slightly elevating practical risk above a purely theoretical flaw. The 'Information Disclosure' tag from the reporter conflicts with the CVSS vector showing VC:N - this discrepancy should be verified against the upstream commit and issue tracker (GitHub issue #26045), as it may indicate the reporter's tag is incorrect or refers to a secondary effect not captured in the base vector. Because radare2 is a developer and researcher tool rather than a network-facing service, exploitation is bounded to users who can execute the binary locally, which significantly limits real-world blast radius. |
| Exploit ScenarioDerived | A local attacker with low-privilege access on a system running radare2 crafts malicious input - such as a specially structured binary or string argument - that triggers the integer overflow in r_str_ndup or r_str_append during processing. The overflow causes an incorrect memory size calculation, leading to a crash of the radare2 process. Public exploit code exists per the CVSS 4.0 E:P rating, lowering the bar for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Integer overflow in radare2's string utility library affects versions up to 6.1.6, allowing a local low-privileged attacker to crash the application through manipulated input processed by r_str_ndup or r_str_append in libr/util/str.c. The impact is limited to availability - no confidentiality or integrity compromise is confirmed by the CVSS 4.0 vector (VC:N/VI:N/VA:L). Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation is confirmed and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
The upstream fix is available as commit a20a56917ae85d732e683f8d9078bdcfee92446c in the radare2 GitHub repository (https://github.com/radareorg/radare2/commit/a20a56917ae85d732e683f8d9078bdcfee92446c); however, no tagged release version incorporating this fix has been independently confirmed from the available intelligence - treat this as an upstream fix available via source, with a formally released patched version not yet verified. Users should build from the patched commit or monitor the radare2 releases page for a version that supersedes 6.1.6 with this fix included. As a compensating control, restrict execution of radare2 to trusted users only, since exploitation requires local low-privileged access; this is already the typical deployment model for a reverse engineering tool. No workarounds that disable the affected string utility functions are practical, as they are core internal APIs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 is a widely-used open-source reverse engineering framework. The affected code resides in libr/util/str.c, specifically the r_str_ndup (bounded string duplication) and r_str_append (string append) utility functions. CWE-189 (Numeric Errors, the parent class of integer overflow) describes the root cause: an arithmetic calculation on size or length operands can wrap around when values exceed the maximum for their integer type, producing an unexpectedly small allocation size. In string-handling functions, this class of flaw typically causes subsequent writes to overflow a short-allocated buffer, but the CVSS 4.0 vector assigns only VA:L with no confidentiality or integrity impact, suggesting the practical outcome is a crash rather than arbitrary memory corruption. The patch is identified at commit a20a56917ae85d732e683f8d9078bdcfee92446c in the upstream GitHub repository.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local attack vector, low privileges to run the tool, no scope change, and only availability impact consistent with a crash from integer overflow.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB