# cve.now: Radareorg

The newest entries naming Radareorg as an affected vendor (up to 200), of 73 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108387](https://cve.now/CVE-2026-108387.md): radare2: Remote code execution when loading Pebble/SMD binary (CVSS 8.5)
- [CVE-2026-112077](https://cve.now/CVE-2026-112077.md): radareorg radare2 HTTP Sandbox Policy rtr\_http.inc.c r\_core\_cmd\_str\_pipe protection mechanism (CVSS 6.3)
- [CVE-2026-81883](https://cve.now/CVE-2026-81883.md): radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode (CVSS 3.3)
- [CVE-2026-81885](https://cve.now/CVE-2026-81885.md): radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSS 5.5)
- [CVE-2026-81882](https://cve.now/CVE-2026-81882.md): radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser (CVSS 3.3)
- [CVE-2026-81886](https://cve.now/CVE-2026-81886.md): radare2: Uncontrolled memory allocation in radare2 dmp64 parser (CVSS 5.5)
- [CVE-2026-81884](https://cve.now/CVE-2026-81884.md): radare2: Heap out-of-bounds read in radare2 Mach-O LC\_DATA\_IN\_CODE parser (CVSS 2.5)
- [CVE-2026-81880](https://cve.now/CVE-2026-81880.md): radare2: Uncontrolled resource consumption in radare2 PEF loader (CVSS 5.5)
- [CVE-2026-81879](https://cve.now/CVE-2026-81879.md): radare2: Heap out-of-bounds read in radare2 ELF PN\_XNUM handling (CVSS 5.5)
- [CVE-2026-81878](https://cve.now/CVE-2026-81878.md): radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser (CVSS 5.5)
- [CVE-2026-81881](https://cve.now/CVE-2026-81881.md): radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser (CVSS 3.3)
- [CVE-2026-14789](https://cve.now/CVE-2026-14789.md): radareorg radare2 Memory64ListStream mdmp.c stack-based overflow (CVSS 4.8)
- [CVE-2026-14788](https://cve.now/CVE-2026-14788.md): radareorg radare2 cfile.c r\_core\_bin\_load use after free (CVSS 4.8)
- [CVE-2026-14787](https://cve.now/CVE-2026-14787.md): radareorg radare2 pb Print cmd\_print.inc cmd\_print integer overflow (CVSS 4.8)
- [CVE-2026-14786](https://cve.now/CVE-2026-14786.md): radareorg radare2 str.c r\_str\_word\_get0set integer overflow (CVSS 4.8)
- [CVE-2026-14761](https://cve.now/CVE-2026-14761.md): radareorg radare2 str.c r\_str\_append integer overflow (CVSS 4.8)
- [CVE-2026-14760](https://cve.now/CVE-2026-14760.md): radareorg radare2 regprofile disasm.c r\_core\_seek\_arch\_bits use after free (CVSS 4.8)
- [CVE-2026-14759](https://cve.now/CVE-2026-14759.md): radareorg radare2 RBinJava Line Number Table class.c r\_bin\_java\_inner\_classes\_attr\_calc\_size heap-based overflow (CVSS 4.8)
- [CVE-2026-14758](https://cve.now/CVE-2026-14758.md): radareorg radare2 hexpairs cmd\_anal.inc.c cmd\_anal\_opcode integer overflow (CVSS 4.8)
- [CVE-2026-14757](https://cve.now/CVE-2026-14757.md): radareorg radare2 cmd\_anal.inc core\_anal\_bytes integer overflow (CVSS 4.8)
- [CVE-2026-6942](https://cve.now/CVE-2026-6942.md): radare2-mcp \<=1.6.0 OS Command Injection via Shell Metacharacter Bypass (CVSS 9.3)
- [CVE-2026-6941](https://cve.now/CVE-2026-6941.md): radare2 \< 6.1.4 Project Notes Path Traversal via Symlink (CVSS 6.9)
- [CVE-2026-6940](https://cve.now/CVE-2026-6940.md): radare2 \< 6.1.4 Project Deletion Path Traversal Directory Deletion (CVSS 6.9)
- [CVE-2026-40517](https://cve.now/CVE-2026-40517.md): radare2 \< 6.1.4 Command Injection via PDB Parser Symbol Names (CVSS 8.4)
- [CVE-2026-40527](https://cve.now/CVE-2026-40527.md): radare2 Command Injection via DWARF Parameter Names (CVSS 8.5)
- [CVE-2026-40499](https://cve.now/CVE-2026-40499.md): radare2 \< 6.1.4 Command Injection via PDB Parser print\_gvars() (CVSS 8.4)
- [CVE-2025-1864](https://cve.now/CVE-2025-1864.md): Buffer Overflow and Potential Code Execution in Radare2 (CVSS 10.0)
- [CVE-2025-1744](https://cve.now/CVE-2025-1744.md): Out-of-bounds Write in radare2 (CVSS 10.0)
- [CVE-2023-5686](https://cve.now/CVE-2023-5686.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.1)
- [CVE-2023-4322](https://cve.now/CVE-2023-4322.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 7.3)
- [CVE-2023-1605](https://cve.now/CVE-2023-1605.md): Denial of Service in radareorg/radare2 (CVSS 7.5)
- [CVE-2023-0302](https://cve.now/CVE-2023-0302.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2 (CVSS 8.6)
- [CVE-2022-4843](https://cve.now/CVE-2022-4843.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 4.4)
- [CVE-2022-4398](https://cve.now/CVE-2022-4398.md): Integer Overflow or Wraparound in radareorg/radare2 (CVSS 6.1)
- [CVE-2022-1899](https://cve.now/CVE-2022-1899.md): Out-of-bounds Read in radareorg/radare2 (CVSS 7.7)
- [CVE-2022-1809](https://cve.now/CVE-2022-1809.md): Access of Uninitialized Pointer in radareorg/radare2 (CVSS 7.4)
- [CVE-2022-1714](https://cve.now/CVE-2022-1714.md): Out-of-bounds Read in radareorg/radare2 (CVSS 7.9)
- [CVE-2022-1649](https://cve.now/CVE-2022-1649.md): Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in radareorg/radare2 (CVSS 7.6)
- [CVE-2022-1451](https://cve.now/CVE-2022-1451.md): Out-of-bounds Read in r\_bin\_java\_constant\_value\_attr\_new function in radareorg/radare2 (CVSS 7.1)
- [CVE-2022-1452](https://cve.now/CVE-2022-1452.md): Out-of-bounds Read in r\_bin\_java\_bootstrap\_methods\_attr\_new function in radareorg/radare2 (CVSS 7.1)
- [CVE-2022-1444](https://cve.now/CVE-2022-1444.md): heap-use-after-free in radareorg/radare2 (CVSS 7.5)
- [CVE-2022-1437](https://cve.now/CVE-2022-1437.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.3)
- [CVE-2022-1383](https://cve.now/CVE-2022-1383.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 4.8)
- [CVE-2022-1382](https://cve.now/CVE-2022-1382.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 5.3)
- [CVE-2022-1297](https://cve.now/CVE-2022-1297.md): Out-of-bounds Read in r\_bin\_ne\_get\_entrypoints function in radareorg/radare2 (CVSS 6.6)
- [CVE-2022-1296](https://cve.now/CVE-2022-1296.md): Out-of-bounds read in \`r\_bin\_ne\_get\_relocs\` function in radareorg/radare2 (CVSS 6.6)
- [CVE-2022-1284](https://cve.now/CVE-2022-1284.md): heap-use-after-free in radareorg/radare2 (CVSS 7.5)
- [CVE-2022-1283](https://cve.now/CVE-2022-1283.md): NULL Pointer Dereference in r\_bin\_ne\_get\_entrypoints function in radareorg/radare2 (CVSS 6.6)
- [CVE-2022-1240](https://cve.now/CVE-2022-1240.md): Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2 (CVSS 7.6)
- [CVE-2022-1237](https://cve.now/CVE-2022-1237.md): Improper Validation of Array Index in radareorg/radare2 (CVSS 7.6)
- [CVE-2022-1238](https://cve.now/CVE-2022-1238.md): Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2 (CVSS 7.6)
- [CVE-2022-1244](https://cve.now/CVE-2022-1244.md): heap-buffer-overflow in radareorg/radare2 (CVSS 7.5)
- [CVE-2022-1207](https://cve.now/CVE-2022-1207.md): Out-of-bounds read in radareorg/radare2 (CVSS 6.6)
- [CVE-2022-1052](https://cve.now/CVE-2022-1052.md): Heap Buffer Overflow in iterate\_chained\_fixups in radareorg/radare2 (CVSS 7.3)
- [CVE-2022-1061](https://cve.now/CVE-2022-1061.md): Heap Buffer Overflow in parseDragons in radareorg/radare2 (CVSS 7.3)
- [CVE-2022-1031](https://cve.now/CVE-2022-1031.md): Use After Free in op\_is\_set\_bp in radareorg/radare2 (CVSS 7.3)
- [CVE-2022-0849](https://cve.now/CVE-2022-0849.md): Use After Free in r\_reg\_get\_name\_idx in radareorg/radare2 (CVSS 7.3)
- [CVE-2022-0695](https://cve.now/CVE-2022-0695.md): Denial of Service in radareorg/radare2 (CVSS 6.8)
- [CVE-2022-0476](https://cve.now/CVE-2022-0476.md): Denial of Service in radareorg/radare2 (CVSS 7.3)
- [CVE-2022-0713](https://cve.now/CVE-2022-0713.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.3)
- [CVE-2022-0712](https://cve.now/CVE-2022-0712.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 5.9)
- [CVE-2022-0676](https://cve.now/CVE-2022-0676.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 7.8)
- [CVE-2022-0559](https://cve.now/CVE-2022-0559.md): Use After Free in radareorg/radare2 (CVSS 8.4)
- [CVE-2022-0522](https://cve.now/CVE-2022-0522.md): Access of Memory Location Before Start of Buffer in radareorg/radare2 (CVSS 6.3)
- [CVE-2022-0521](https://cve.now/CVE-2022-0521.md): Access of Memory Location After End of Buffer in radareorg/radare2 (CVSS 6.3)
- [CVE-2022-0520](https://cve.now/CVE-2022-0520.md): Use After Free in radareorg/radare2 (CVSS 8.8)
- [CVE-2022-0519](https://cve.now/CVE-2022-0519.md): Buffer Access with Incorrect Length Value in radareorg/radare2 (CVSS 6.3)
- [CVE-2022-0518](https://cve.now/CVE-2022-0518.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 6.3)
- [CVE-2022-0139](https://cve.now/CVE-2022-0139.md): Use After Free in radareorg/radare2 (CVSS 7.1)
- [CVE-2022-0523](https://cve.now/CVE-2022-0523.md): Use After Free in radareorg/radare2 (CVSS 8.8)
- [CVE-2022-0419](https://cve.now/CVE-2022-0419.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 5.9)
- [CVE-2022-0173](https://cve.now/CVE-2022-0173.md): Out-of-bounds Read in radareorg/radare2 (CVSS 9.6)
- [CVE-2020-15121](https://cve.now/CVE-2020-15121.md): Command injection in Radare2 (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/radareorg
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.