What is the CVSS score of CVE-2026-45324?

CVE-2026-45324 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45324?

Yes, a patch is available for CVE-2026-45324. Update the affected software to the latest version immediately.

Rizin CVE-2026-45324

EUVD-2026-33424 LOW

Double Free (CWE-415)

2026-05-29 GitHub_M

Information Disclosure Rizin Rizinorg

3.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.3 LOW

AV:P/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Source Code Evidence Fetched

May 29, 2026 - 19:47 vuln.today

Analysis Generated

May 29, 2026 - 19:47 vuln.today

DescriptionCVE.org

Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.

AnalysisAI

Double free memory corruption in Rizin's byte_pattern_search() function (librz/core/cmd/cmd_search.c) arises from incorrect pointer ownership declarations, allowing a low-privileged local attacker with physical access to cause low-integrity and low-availability impacts under high-complexity conditions requiring user interaction. The CVSS score of 3.3 (Low) reflects the extremely constrained attack surface: physical presence, high complexity, and mandatory user interaction all limit practical exploitability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Rizin is an open-source, UNIX-like reverse engineering framework and command-line toolset (CPE: cpe:2.3:a:rizinorg:rizin:*:*:*:*:*:*:*:*). The root cause is CWE-415 (Double Free): in the byte_pattern_search() function within librz/core/cmd/cmd_search.c, a pointer is freed more than once due to incorrect pointer ownership semantics being declared in the surrounding logic. The associated commit (045fff363b42b8a6dda8ad5229c29ec3267e7dbe) also refactors boundary-handling code in cbounds.c and cconfig.c, decomposing rz_core_get_boundaries_select() into a cleaner rz_core_get_boundaries() abstraction - suggesting the ownership confusion may have been compounded by the broader architectural complexity of the search boundary resolution subsystem. Double free vulnerabilities in C/C++ can in principle lead to heap metadata corruption, but the constrained CVSS vector (AV:P/AC:H/PR:L/UI:R/S:C) limits realistic impact to integrity and availability degradation rather than code execution.

RemediationAI

The upstream fix is available via commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe at https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe. Users building Rizin from source should update to a revision at or after this commit. A formally released patched version with a version tag has not been independently confirmed from the available data - monitor the GitHub releases page and the security advisory at https://github.com/rizinorg/rizin/security/advisories/GHSA-2377-chx7-xf7c for an official tagged release. As a compensating control, given the AV:P attack vector, organizations should enforce physical access controls to workstations running Rizin and restrict usage to trusted analysts - this effectively neutralizes the attack vector without requiring an immediate patch. No known functional trade-offs apply to this workaround.