EUVD-2026-84469Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed dmp64 crash dump
-
DeliveryDeliver file to analyst
-
ExploitVictim opens dump in radare2
-
ExecutionUnbounded page-descriptor allocation loop
-
ImpactMemory/CPU exhaustion crashes tool
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied, specially crafted full-memory Windows crash dump (dmp64 format) in radare2 versions prior to 6.2.0; this triggers the Windows 64-bit dmp64 parser (libr/bin/format/dmp/dmp64.c) which uses the input-controlled physical-memory-run PageCount/NumberOfRuns as the bound of a per-page allocation loop without validating it against the actual dump size. Limiting factors: the attack is local (the file must reach and be opened by the analyst, UI:R), impact is confined to denial of service (excessive memory consumption and processing time) of the radare2 process, and there is no code execution or data disclosure. The dmp64 format is Windows-specific, but radare2 parses it cross-platform, so no particular host OS is required. |
| Impact | All signals point to a genuine-but-low-priority memory-exhaustion DoS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: the flaw is only reachable when a user opens a crafted Windows dmp64 crash dump in radare2, so the attack is local (AV:L) and requires victim interaction (UI:R), with the only impact being availability (A:H) via uncontrolled memory/CPU consumption - no confidentiality or integrity loss, matching CWE-770. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code supplied in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision block provided. The bug is not automatable in any wormable sense because it needs a human to open a malicious file in an analysis tool. Net: this is a real, patch-worthy quality/robustness bug (fixed in 6.2.0 with overflow-checked run/page-count validation), not a high-urgency exploitation risk. The 5.5 medium rating is fair and there is no gap between the CVSS narrative and the description. |
| Exploit ScenarioDerived | An attacker crafts a small malformed full-memory Windows crash dump whose physical-memory-run PageCount and NumberOfRuns fields declare far more pages than the tiny file actually contains, then delivers it to a malware/forensics analyst (e.g., as a sample to triage). When the analyst opens it in radare2, the unvalidated per-page allocation loop appends page descriptors until memory and processing time are exhausted, hanging or crashing the tool. No public POC was provided in the intelligence, and exploitation requires the victim to open the file (UI:R, AV:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Denial of service in radare2 versions prior to 6.2.0 allows an attacker to exhaust memory and processing time in the analyst's session by supplying a small crafted full-memory Windows crash dump (dmp64 format), which the 64-bit dump parser opens without validating input-controlled page counts against the actual file size. Exploitation is local and requires user interaction - a victim must open the malicious dump (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - and the impact is confined to availability, with no code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Vendor-released patch: radare2 6.2.0 (https://github.com/radareorg/radare2/releases/tag/6.2.0), which contains the validated-allocation rewrite from pull request https://github.com/radareorg/radare2/pull/26180 and commit https://github.com/radareorg/radare2/commit/a7519fdb4da6835c2cecd8fe248e7dd1133cf17a; upgrade to 6.2.0 or later and confirm the vendor advisory at https://github.com/radareorg/radare2/security/advisories/GHSA-3xrx-wh64-8xr8 for any additional release guidance. If upgrading cannot be done immediately, the practical compensating control is to avoid opening untrusted or unsolicited dmp64 crash dumps in radare2 - the trigger is simply loading the file, so quarantining unknown dumps or pre-screening them with file/magic checks and validating their size against declared page counts outside radare2 removes the exposure, at the cost of manual triage effort. Additionally, run radare2 on untrusted dumps inside a container or shell with a hard memory cap (ulimit -v, systemd MemoryMax, or a cgroup limit) so that a malicious PageCount terminates the process rather than starving the host; the trade-off is that this converts the DoS into an abrupt, ungraceful process kill and can also abort legitimate analysis of very large dumps. Because the attack requires local file delivery and user interaction, standard controls restricting who can hand dumps to an analyst, plus not running radare2 with elevated privileges on untrusted input, meaningfully reduce the practical attack surface. No public exploit code was identified at time of analysis, so these measures are precautionary rather than incident-driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2's binary loader contains a Windows 64-bit crash-dump parser in libr/bin/format/dmp/dmp64.c that walks the PhysicalMemoryBlock structure: a header-level memory descriptor holds NumberOfRuns, and each run carries a BasePage and an input-controlled PageCount. In versions prior to 6.2.0 the parser read the run array with a single r_buf_read_at and then iterated the outer run loop with an inner per-page loop bounded directly by run->PageCount, allocating and appending a page descriptor to an r_list on every iteration. This is CWE-770 (Allocation of Resources Without Limits or Throttling): the allocation loop had no ceiling tied to the dump's actual size, so a tiny file declaring an enormous PageCount (and/or an inflated NumberOfRuns) drives repeated allocation and list growth, resulting in memory exhaustion and long processing times. The fix in PR #26180 (commit a7519fdb4da6835c2cecd8fe248e7dd1133cf17a) introduces overflow-checked reads (r_read_le32/r_read_le64), validates NumberOfRuns against the space between PhysicalMemoryBlockBuffer and ContextRecord, derives max_file_pages from the real file size relative to DMP_PAGE_SIZE, rejects PageCount values exceeding that budget or ST32_MAX, and checks base_page + page_count - 1 for overflow before any allocation loop runs. The affected CPE entry cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:* is a wildcard, so version scoping must come from the advisory: everything below 6.2.0. Because radare2 parses the Windows-specific dmp64 format on any host platform, the vulnerability is not limited to Windows installations of radare2 despite the format's origin.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file must be opened by the victim (AV:L, UI:R), no privileges or auth needed (PR:N), and the sole impact is process memory/CPU exhaustion (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size. This can cause denial of service through excessive memory consumption and processing time. This issue is fixed in version 6.2.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
Exploit-DB