EUVD-2026-41800
GHSA-v7rq-pxrj-v6m8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege requirement; impact is crash-only per CVSS 4.0 metrics, so C:N and I:N with A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.
AnalysisAI
Stack-based buffer overflow in radare2 up to version 6.1.6 allows a local low-privileged attacker to crash the application by supplying a crafted MDMP (Windows minidump) file that triggers a memory corruption in the Memory64ListStream parser. Impact is limited to availability - no confidentiality or integrity compromise is indicated by the CVSS 4.0 vector (VC:N/VI:N/VA:L). A public proof-of-concept exists via GitHub issue #26051, and an upstream patch commit is available, though no formally tagged release version has been confirmed in the provided data.
Technical ContextAI
radare2 is an open-source, cross-platform reverse engineering framework used extensively by security researchers and malware analysts to disassemble, debug, and analyze binaries. The vulnerability resides in libr/bin/format/mdmp/mdmp.c, specifically in the parser for the Memory64ListStream stream type of the MDMP (Microsoft MiniDump) file format. CWE-121 (Stack-Based Buffer Overflow) indicates that when processing a Memory64List structure, the parser fails to adequately validate the size or count of memory region entries before copying data onto the stack, resulting in stack corruption. Because radare2 is routinely used to open untrusted or adversary-supplied binaries, this parser path is a natural attack surface for a malicious MDMP file. The affected CPE is cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:* up to version 6.1.6.
RemediationAI
Apply the upstream patch commit 175d4addb68981331c85b10681c2161c38fb5762, available at https://github.com/mengzhisuoliu/radare2/commit/175d4addb68981331c85b10681c2161c38fb5762. Monitor the official radare2 repository at https://github.com/radareorg/radare2/ for a formally tagged release that includes this fix, as the exact patched release version was not confirmed in the available data. As a compensating control in the interim, analysts can avoid opening untrusted MDMP files with radare2, or sandbox radare2 sessions using tools such as bubblewrap, firejail, or a disposable container - this directly mitigates the local attack path without requiring a code change. The trade-off of sandboxing is slightly reduced convenience for analysts doing interactive debugging.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today