EUVD-2026-41771
GHSA-q4m4-82h9-qfgv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector, low privileges to run the tool, no scope change, and only availability impact consistent with a crash from integer overflow.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Integer overflow in radare2's string utility library affects versions up to 6.1.6, allowing a local low-privileged attacker to crash the application through manipulated input processed by r_str_ndup or r_str_append in libr/util/str.c. The impact is limited to availability - no confidentiality or integrity compromise is confirmed by the CVSS 4.0 vector (VC:N/VI:N/VA:L). Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation is confirmed and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
radare2 is a widely-used open-source reverse engineering framework. The affected code resides in libr/util/str.c, specifically the r_str_ndup (bounded string duplication) and r_str_append (string append) utility functions. CWE-189 (Numeric Errors, the parent class of integer overflow) describes the root cause: an arithmetic calculation on size or length operands can wrap around when values exceed the maximum for their integer type, producing an unexpectedly small allocation size. In string-handling functions, this class of flaw typically causes subsequent writes to overflow a short-allocated buffer, but the CVSS 4.0 vector assigns only VA:L with no confidentiality or integrity impact, suggesting the practical outcome is a crash rather than arbitrary memory corruption. The patch is identified at commit a20a56917ae85d732e683f8d9078bdcfee92446c in the upstream GitHub repository.
RemediationAI
The upstream fix is available as commit a20a56917ae85d732e683f8d9078bdcfee92446c in the radare2 GitHub repository (https://github.com/radareorg/radare2/commit/a20a56917ae85d732e683f8d9078bdcfee92446c); however, no tagged release version incorporating this fix has been independently confirmed from the available intelligence - treat this as an upstream fix available via source, with a formally released patched version not yet verified. Users should build from the patched commit or monitor the radare2 releases page for a version that supersedes 6.1.6 with this fix included. As a compensating control, restrict execution of radare2 to trusted users only, since exploitation requires local low-privileged access; this is already the typical deployment model for a reverse engineering tool. No workarounds that disable the affected string utility functions are practical, as they are core internal APIs.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-189 – Numeric Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today