EUVD-2026-41797
GHSA-4m93-7925-jv2p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local execution with low privileges triggers the integer overflow; impact is limited to a radare2 process crash with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
AnalysisAI
Integer overflow in radare2's pb Print Command Handler affects all versions through 6.1.6, exploitable locally by a low-privileged user to crash the radare2 process. The flaw resides in the cmd_print function within libr/core/cmd_print.inc and results in availability impact only - no confidentiality or integrity loss is indicated. Publicly available exploit code exists per the GitHub issue tracker, though no active exploitation has been confirmed via CISA KEV.
Technical ContextAI
radare2 is an open-source, command-line reverse engineering framework widely used by security researchers and malware analysts for binary analysis, disassembly, and debugging. The vulnerable component is the pb (print binary) command handler, implemented in the cmd_print function within libr/core/cmd_print.inc. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation produces a value exceeding the maximum representable integer, causing incorrect memory size calculations that can lead to buffer misalignment or an out-of-bounds memory condition - consistent with the 'Buffer Overflow' tag alongside 'Integer Overflow' in the intelligence data. The affected CPE is cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*, covering all radare2 releases up to and including version 6.1.6.
RemediationAI
Apply the upstream patch commit 2b6265476c75567006b0fcbb749f4ae7b189c5df, available at https://github.com/phix33/radare2/commit/2b6265476c75567006b0fcbb749f4ae7b189c5df. Note that this is a commit-level fix; a corresponding tagged stable release version is not confirmed in the available data, so users should build from the patched commit or monitor the official radare2 repository at https://github.com/radareorg/radare2/ for a versioned release. As a compensating control until a patched release is available, avoid invoking the pb print command against untrusted or externally-sourced input. Users who routinely analyze potentially malicious binaries should consider running radare2 in an isolated sandbox or container to limit the impact of a tool crash.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today