Radare Radare2
171 CVEs affecting Radare Radare2. Latest disclosed: 2026-07-06. Critical: 14, High: 67.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32495 | Critical | 10.0 | 2023-07-07 | Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to ca… |
CVE-2021-32494 | Critical | 10.0 | 2023-07-07 | Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial o… |
CVE-2025-1864 | Critical | 9.8 | 2025-03-03 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2… |
CVE-2025-1744 | Critical | 9.8 | 2025-02-28 | Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9. |
CVE-2024-29646 | Critical | 9.8 | 2024-12-17 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields. |
CVE-2023-46570 | Critical | 9.8 | 2023-10-28 | An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h. |
CVE-2023-46569 | Critical | 9.8 | 2023-10-28 | An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h. |
CVE-2023-4322 | Critical | 9.8 | 2023-08-14 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. |
CVE-2022-0559 | Critical | 9.8 | 2022-02-16 | Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. |
CVE-2022-0139 | Critical | 9.8 | 2022-02-08 | Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0. |
CVE-2020-27794 | Critical | 9.1 | 2022-08-19 | A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and p… |
CVE-2022-1899 | Critical | 9.1 | 2022-05-26 | Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. |
CVE-2022-1297 | Critical | 9.1 | 2022-04-11 | Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read s… |
CVE-2022-1296 | Critical | 9.1 | 2022-04-11 | Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sens… |
CVE-2023-5686 | High | 8.8 | 2023-10-20 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. |
CVE-2024-11858 | High | 8.6 | 2024-12-15 | A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. M… |
CVE-2026-40517 | High | 7.8 | 2026-04-22 | radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary command… |
CVE-2026-40527 | High | 7.8 | 2026-04-17 | radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 com… |
CVE-2026-40499 | High | 7.8 | 2026-04-15 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary… |
CVE-2024-29645 | High | 7.8 | 2024-12-02 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. |