EUVD-2026-41800
GHSA-v7rq-pxrj-v6m8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious MDMP file
-
DeliveryDeliver file to target analyst
-
ExploitAnalyst opens file in radare2
-
ExecutionMemory64ListStream parser overflows stack
-
Impactradare2 process crashes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to supply a maliciously crafted MDMP file to a user who then opens it with radare2 on a local system. Low OS-level privileges are sufficient (PR:L per CVSS 4.0); no elevated or administrative rights are required. The vulnerable code path is only triggered when radare2 processes an MDMP file containing a Memory64ListStream with malformed parameters in libr/bin/format/mdmp/mdmp.c. Exploitation is limited by: (1) local attack vector - no network exploitation path exists; (2) the analyst must explicitly open the malicious file; (3) impact is a crash only, not arbitrary code execution per the CVSS 4.0 impact metrics (VC:N/VI:N/VA:L). The vulnerability does not affect default configurations of other software - it is specific to radare2's MDMP parsing functionality. |
| Impact | The overall real-world risk is very low. The CVSS 4.0 score of 1.9 reflects a local attack vector (AV:L), low-privilege requirement (PR:L), and impact restricted solely to low availability (VA:L) - no confidentiality or integrity impact is present. This is essentially a crash-on-malicious-input scenario, not a code execution primitive. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, confirming no observed active exploitation at scale. However, a public proof-of-concept exists (GitHub issue #26051), which lowers the bar for triggering the crash. For the typical radare2 user - a security analyst opening untrusted files by design - this POC represents a nuisance-level DoS rather than a critical threat. The low CVSS score and constrained impact are consistent with each other and with the description; no conflicting signals were identified. |
| Exploit ScenarioDerived | An attacker provides a reverse engineer or malware analyst with a specially crafted Windows minidump (MDMP) file - for example, disguised as a crash dump from a target application. When the analyst opens the file in radare2 (version 6.1.6 or earlier), the Memory64ListStream parser overflows the stack, causing radare2 to crash. A public proof-of-concept demonstrating this crash behavior is available via GitHub issue #26051. Based on the CVSS impact metrics (VA:L only), code execution is not indicated, making this a denial-of-service rather than a compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Stack-based buffer overflow in radare2 up to version 6.1.6 allows a local low-privileged attacker to crash the application by supplying a crafted MDMP (Windows minidump) file that triggers a memory corruption in the Memory64ListStream parser. Impact is limited to availability - no confidentiality or integrity compromise is indicated by the CVSS 4.0 vector (VC:N/VI:N/VA:L). A public proof-of-concept exists via GitHub issue #26051, and an upstream patch commit is available, though no formally tagged release version has been confirmed in the provided data.
RemediationAI
Apply the upstream patch commit 175d4addb68981331c85b10681c2161c38fb5762, available at https://github.com/mengzhisuoliu/radare2/commit/175d4addb68981331c85b10681c2161c38fb5762. Monitor the official radare2 repository at https://github.com/radareorg/radare2/ for a formally tagged release that includes this fix, as the exact patched release version was not confirmed in the available data. As a compensating control in the interim, analysts can avoid opening untrusted MDMP files with radare2, or sandbox radare2 sessions using tools such as bubblewrap, firejail, or a disposable container - this directly mitigates the local attack path without requiring a code change. The trade-off of sandboxing is slightly reduced convenience for analysts doing interactive debugging.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 is an open-source, cross-platform reverse engineering framework used extensively by security researchers and malware analysts to disassemble, debug, and analyze binaries. The vulnerability resides in libr/bin/format/mdmp/mdmp.c, specifically in the parser for the Memory64ListStream stream type of the MDMP (Microsoft MiniDump) file format. CWE-121 (Stack-Based Buffer Overflow) indicates that when processing a Memory64List structure, the parser fails to adequately validate the size or count of memory region entries before copying data onto the stack, resulting in stack corruption. Because radare2 is routinely used to open untrusted or adversary-supplied binaries, this parser path is a natural attack surface for a malicious MDMP file. The affected CPE is cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:* up to version 6.1.6.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local vector with low-privilege requirement; impact is crash-only per CVSS 4.0 metrics, so C:N and I:N with A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in radare2 Memory Safety and Arithmetic Flaws
View all 4An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB