Radareorg Radare2
28 CVEs affecting Radareorg Radare2. Latest disclosed: 2026-10-19. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6942 | Critical | 9.8 | 2026-04-23 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing th… |
CVE-2025-1864 | Critical | 9.8 | 2025-03-03 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2… |
CVE-2025-1744 | Critical | 9.8 | 2025-02-28 | Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9. |
CVE-2026-40517 | High | 7.8 | 2026-04-22 | radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary command… |
CVE-2026-40527 | High | 7.8 | 2026-04-17 | radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 com… |
CVE-2026-40499 | High | 7.8 | 2026-04-15 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary… |
CVE-2020-15121 | High | 7.4 | 2020-07-20 | In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the execut… |
CVE-2026-6940 | High | 7.1 | 2026-04-23 | radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by s… |
CVE-2026-6941 | Medium | 6.6 | 2026-04-23 | radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configure… |
CVE-2026-112077 | Medium | 5.6 | 2026-10-19 | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of t… |
CVE-2026-81886 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable… |
CVE-2026-81885 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable becaus… |
CVE-2026-81880 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerabl… |
CVE-2026-81879 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF pa… |
CVE-2026-81878 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable be… |
CVE-2026-14757 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulatio… |
CVE-2026-81883 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable becaus… |
CVE-2026-81882 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable bec… |
CVE-2026-81881 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable beca… |
CVE-2026-14789 | Low | 3.3 | 2026-07-06 | A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of… |