EUVD-2026-41799
GHSA-3h4h-fp54-55h6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with PR:L because exploitation requires an authenticated local user running radare2 against a crafted file; only process availability is impacted.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.
AnalysisAI
Use-after-free in radare2's r_core_bin_load function (libr/core/cfile.c) affects all versions up to and including 6.1.6, allowing a local low-privileged user to trigger memory corruption resulting in a denial of service. A public proof-of-concept exists (GitHub issue #26049), confirmed by the CVSS 4.0 E:P exploitability modifier, though the vulnerability is not listed in CISA KEV and no confirmed widespread active exploitation is known. The CVSS 4.0 score of 4.8 (Medium) reflects the strictly local attack vector, limited availability impact, and absence of confidentiality or integrity compromise.
Technical ContextAI
radare2 is an open-source reverse engineering framework developed by radareorg, widely used by security researchers and malware analysts to inspect binary files. The vulnerable code path resides in the r_core_bin_load function within libr/core/cfile.c, which is responsible for loading and parsing binary executables for analysis. CWE-416 (Use After Free) describes the root cause: a memory region is freed but a reference to it is retained and subsequently dereferenced, producing undefined behavior. In this case, the CVSS metrics constrain the observable impact to availability (VA:L) - consistent with a process crash rather than arbitrary code execution - though use-after-free primitives can theoretically be escalated under specific memory layout conditions. The affected CPE cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:* covers all platform variants through version 6.1.6.
RemediationAI
The upstream fix is available as commit 635ab1eeb30340c26076722a90cb91fb2272130b, accessible at https://github.com/oldzhu/radare2/commit/635ab1eeb30340c26076722a90cb91fb2272130b. Users should update to the first tagged radare2 release that incorporates this commit; a specific patched release version number was not independently confirmed in the available data - users should monitor https://github.com/radareorg/radare2/ for a tagged release post-dating this commit. As an interim compensating control, avoid opening untrusted or externally sourced binary files with radare2 until the patch is applied; this directly eliminates the attack vector with no functionality impact for analysts working exclusively with trusted binaries. For automated analysis pipelines that ingest untrusted binaries, running radare2 in an isolated sandbox or container limits the blast radius of a triggered crash to that process only.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today