EUVD-2026-33423Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a heap-buffer-overflow in librz/bin/format/omf/omf.c. This vulnerability is fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.
AnalysisAI
Heap out-of-bounds read in Rizin's OMF binary parser exposes heap memory contents when a user opens a maliciously crafted Object Module Format file. An off-by-one bounds check error in the rz_bin_omf_get_entry function within librz/bin/format/omf/omf.c allows array access one element past the end of the allocated sections array, resulting in limited confidentiality impact (heap data disclosure). No public exploit exists and this is not listed in CISA KEV; the CVSS score of 3.3 accurately reflects constrained real-world risk due to local-only access and mandatory user interaction.
Technical ContextAI
Rizin is a UNIX-like reverse engineering framework (CPE: cpe:2.3:a:rizinorg:rizin:*:*:*:*:*:*:*:*) that parses numerous binary formats including OMF (Object Module Format), a legacy format used for DOS/Windows object files. The root cause is CWE-125 (Out-of-bounds Read): in rz_bin_omf_get_entry, the original bounds check evaluated obj->symbols[ct_sym]->seg_idx - 1 > obj->nb_section using strict greater-than, which incorrectly permits array access at index nb_section - one past the last valid index (0 through nb_section-1). The fix introduces a named variable sec_arr_offset and corrects the comparison to >= obj->nb_section, closing the off-by-one. The heap read leaks whatever data resides immediately after the sections array in memory, bounded to a single pointer-sized access.
RemediationAI
The upstream fix is available via commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47 (https://github.com/rizinorg/rizin/commit/e6d0937c8a083e23ed76ccfb9f631cdc50c7af47); users should update to the Rizin release that includes this commit once a tagged version is published - the exact patched release version is not confirmed from available data, so monitor the GitHub advisory at https://github.com/rizinorg/rizin/security/advisories/GHSA-wprr-wrcw-mw6v for release details. As a low-disruption workaround until patching, avoid opening untrusted OMF-format binary files with Rizin, since OMF is a legacy DOS/Windows format rarely required in modern analysis workflows - restricting input to known-good samples eliminates the attack surface with minimal operational impact.
Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). Rated medium se
rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis
A vulnerability was found in rizinorg rizin up to 0.7.4. Rated medium severity (CVSS 4.8), this vulnerability is low att
A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0. Rated medium severity (CVSS
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Rated high severity (CVSS 7.8), this vulner
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today