Radareorg vulnerabilities
73 CVEs and advisories name Radareorg as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108387radare2: Remote code execution when loading Pebble/SMD binary
- CVE-2026-112077radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism
- CVE-2026-81883radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode
- CVE-2026-81885radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser
- CVE-2026-81882radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
- CVE-2026-81886radare2: Uncontrolled memory allocation in radare2 dmp64 parser
- CVE-2026-81884radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
- CVE-2026-81880radare2: Uncontrolled resource consumption in radare2 PEF loader
- CVE-2026-81879radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
- CVE-2026-81878radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
- CVE-2026-81881radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
- CVE-2026-14789radareorg radare2 Memory64ListStream mdmp.c stack-based overflow
- CVE-2026-14788radareorg radare2 cfile.c r_core_bin_load use after free
- CVE-2026-14787radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow
- CVE-2026-14786radareorg radare2 str.c r_str_word_get0set integer overflow
- CVE-2026-14761radareorg radare2 str.c r_str_append integer overflow
- CVE-2026-14760radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
- CVE-2026-14759radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow
- CVE-2026-14758radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow
- CVE-2026-14757radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow
- CVE-2026-6942radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
- CVE-2026-6941radare2 < 6.1.4 Project Notes Path Traversal via Symlink
- CVE-2026-6940radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
- CVE-2026-40517radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
- CVE-2026-40527radare2 Command Injection via DWARF Parameter Names
- CVE-2026-40499radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()
- CVE-2025-1864Buffer Overflow and Potential Code Execution in Radare2
- CVE-2025-1744Out-of-bounds Write in radare2
- CVE-2023-5686Heap-based Buffer Overflow in radareorg/radare2
- CVE-2023-4322Heap-based Buffer Overflow in radareorg/radare2