EUVD-2026-41797
GHSA-4m93-7925-jv2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to system running radare2
-
DeliveryCraft malformed input targeting pb command
-
ExploitInvoke pb command within radare2 session
-
ExecutionTrigger integer overflow in cmd_print function
-
ImpactCrash radare2 process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a system where radare2 is installed and the ability to execute it with low privileges (e.g., a standard user account). The vulnerability is triggered by invoking the pb (print binary) command within radare2 with crafted input that causes integer overflow in the cmd_print handler - no special system configuration, elevated privileges, or specific compilation options are required beyond having a vulnerable version of radare2 available. Remote exploitation is not possible per AV:L in the CVSS 4.0 vector. Integrity and confidentiality are unaffected (VC:N/VI:N per CVSS 4.0); impact is confined to crashing the radare2 process. The primary exploitation limit is the local-only attack vector, meaning network-exposed systems are not at risk unless radare2 is invoked as part of an automated remote analysis pipeline. |
| Impact | The CVSS 4.0 score of 4.8 with vector AV:L/AC:L/AT:N/PR:L/UI:N reflects realistic risk: local access and low privileges are required, and impact is limited to VA:L (low availability on the vulnerable system only) with no confidentiality or integrity impact. The E:P modifier confirms publicly available POC, which lowers exploitation effort but does not elevate scope. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. The real-world risk is narrow: it primarily threatens security analysts who run radare2 against untrusted or attacker-controlled binaries, where the tool crash could interrupt analysis workflows. This is not a priority for general enterprise patching but is relevant to security teams and CTF/malware analysis environments where radare2 is actively used. |
| Exploit ScenarioDerived | A local low-privileged user, or a crafted binary designed to elicit specific analysis commands, supplies malformed input to radare2's pb print command within an interactive session or automated analysis script. The crafted input triggers an integer overflow in the cmd_print function, corrupting internal state and causing radare2 to crash. A publicly available POC demonstrating this behavior is referenced in GitHub issue https://github.com/radareorg/radare2/issues/26048, confirming the attack is reproducible with minimal effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Integer overflow in radare2's pb Print Command Handler affects all versions through 6.1.6, exploitable locally by a low-privileged user to crash the radare2 process. The flaw resides in the cmd_print function within libr/core/cmd_print.inc and results in availability impact only - no confidentiality or integrity loss is indicated. Publicly available exploit code exists per the GitHub issue tracker, though no active exploitation has been confirmed via CISA KEV.
RemediationAI
Apply the upstream patch commit 2b6265476c75567006b0fcbb749f4ae7b189c5df, available at https://github.com/phix33/radare2/commit/2b6265476c75567006b0fcbb749f4ae7b189c5df. Note that this is a commit-level fix; a corresponding tagged stable release version is not confirmed in the available data, so users should build from the patched commit or monitor the official radare2 repository at https://github.com/radareorg/radare2/ for a versioned release. As a compensating control until a patched release is available, avoid invoking the pb print command against untrusted or externally-sourced input. Users who routinely analyze potentially malicious binaries should consider running radare2 in an isolated sandbox or container to limit the impact of a tool crash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 is an open-source, command-line reverse engineering framework widely used by security researchers and malware analysts for binary analysis, disassembly, and debugging. The vulnerable component is the pb (print binary) command handler, implemented in the cmd_print function within libr/core/cmd_print.inc. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation produces a value exceeding the maximum representable integer, causing incorrect memory size calculations that can lead to buffer misalignment or an out-of-bounds memory condition - consistent with the 'Buffer Overflow' tag alongside 'Integer Overflow' in the intelligence data. The affected CPE is cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*, covering all radare2 releases up to and including version 6.1.6.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local execution with low privileges triggers the integer overflow; impact is limited to a radare2 process crash with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in radare2 Memory Safety and Arithmetic Flaws
View all 4An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB