EUVD-2026-30635
GHSA-8j42-xqfj-g726
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise GDB server
-
DeliveryWait for radare2 connection
-
ExploitSend valid qfThreadInfo response
-
ExecutionSend malformed qsThreadInfo response
-
PersistTrigger use-after-free
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against radare2 6.1.5 when using the GDB client functionality to connect to any GDB server. The key limitation is that a user must actively connect radare2 to an attacker-controlled GDB server, making this primarily a risk in scenarios where users debug untrusted remote targets or connect through compromised debugging infrastructure. |
| Impact | The CVSS 4.0 score of 8.7 indicates high severity with network attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N). However, real-world exploitation risk appears moderate as it requires an attacker to control or compromise a GDB server that radare2 connects to. No EPSS score is provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. The primary impact is availability (VA:H) with no confidentiality or integrity impact scored. This aligns with a denial of service vulnerability, though the description mentions potential arbitrary code execution which would typically warrant VC:H/VI:H scoring. Exploit complexity is low once an attacker controls the GDB server responses. |
| Exploit ScenarioDerived | An attacker sets up a malicious GDB server and waits for a radare2 user to connect for remote debugging. When radare2 queries for thread information, the malicious server sends a valid response to qfThreadInfo causing memory allocation, then sends a malformed response to the subsequent qsThreadInfo query triggering the vulnerability and potentially crashing radare2 or achieving code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 15, 2026
Memory corruption in radare2 6.1.5's GDB client allows remote attackers to crash the application or potentially execute code through malformed thread information responses. The vulnerability triggers when the GDB remote protocol's qsThreadInfo command fails after qfThreadInfo has allocated memory, causing a use-after-free condition. While no public exploits have been identified, the CVSS 8.7 score reflects the potential for remote unauthenticated denial of service impact.
RemediationAI
Update radare2 to a version containing commit c213ad6894a1eb9086ac8bf5fae35757e9e1683c or later. The patch properly initializes dpid pointers to NULL after freeing and checks for NULL before attempting to free memory, preventing the use-after-free condition. As a workaround until patching, avoid connecting radare2's GDB client to untrusted or potentially compromised GDB servers. The vulnerability advisory is available at https://www.vulncheck.com/advisories/radare2-use-after-free-via-gdbr-pids-list with issue tracking at https://github.com/radareorg/radare2/issues/25836.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gdbr_pids_list() function within radare2's GDB remote protocol client implementation. This function processes thread information responses from GDB servers using the qfThreadInfo/qsThreadInfo protocol commands. The root cause is improper memory management (CWE-416 Use After Free) where RDebugPid structures allocated during successful qfThreadInfo processing are not properly tracked when qsThreadInfo fails, leading to double-free conditions in the error cleanup path. The GDB remote protocol is commonly used for debugging embedded systems and remote targets.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.
Executive ViewAI
CVE-2026-8696 is a memory corruption vulnerability in radare2 6.1.5's GDB client that enables remote unauthenticated attackers to crash the application or potentially execute arbitrary code through malformed protocol responses. Organizations using radare2 for reverse engineering or malware analysis face service disruption and potential compromise if exposed to untrusted GDB targets. Immediate inventory and isolation of affected systems is required until patching becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict radare2 GDB client connectivity to trusted, isolated GDB servers only; (2) Run radare2 in containerized or sandboxed environments with resource limits to contain crash impact; (3) Implement network-level filtering to prevent connection to untrusted GDB services; (4) Monitor for abnormal GDB protocol responses and radare2 process crashes as early warning indicators. Monitor vendor security advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB