Buffer overflow in Rizinorg Rizin
CVE-2025-1786
A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the library /librz/bin/pdb/pdb.c. The manipulation of the argument -P leads to buffer over…
Vulnerability class: Buffer Overflow
EPSS: 0.000 (10.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Rizinorg Rizin — versions 0.7.0, 0.7.1, 0.7.2
Weakness classification (CWE)
References
- VDB-298007 | rizinorg rizin pdb.c msf_stream_directory_free buffer overflow (vdb-entry, technical-description)
- VDB-298007 | CTI Indicators (IOB, IOC, IOA) (signature, permissions-required)
- Submit #502317 | https://github.com/rizinorg/rizin rizin/rz-bin 309f57434dfa17954f02cdcbb3a2ac4108651767 Buffer Over-read (third-party-advisory)
- github.com/rizinorg/rizin/issues/4893 (issue-tracking)
- github.com/user-attachments/files/18765730/rz-bin-6fb50-poc.zip (exploit)
- github.com/rizinorg/rizin/milestone/18 (patch)
Frequently asked questions
- What is CVE-2025-1786?
- CVE-2025-1786 is a medium-severity vulnerability in Rizinorg Rizin, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 5.3/10. Published 2025-03-01.
- How severe is CVE-2025-1786?
- Medium severity. CVSS v3 base score is 5.3 out of 10.