Radare 2 any version

Out-of-bounds Write in radare2

Buffer Overflow and Potential Code Execution in Radare2

Use After Free in radareorg/radare2

Use After Free in radareorg/radare2

radare2 6.1.5 Use-After-Free via gdbr_threads_list()

radare2 6.1.5 Use-After-Free via gdbr_pids_list()

Heap-based Buffer Overflow in radareorg/radare2

An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.

An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.

Command injection in Radare2

Out-of-bounds Read in radareorg/radare2

Out-of-bounds Read in radareorg/radare2

A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash.

Out-of-bounds Read in r_bin_ne_get_entrypoints function in radareorg/radare2

Out-of-bounds read in `r_bin_ne_get_relocs` function in radareorg/radare2

Use After Free in radareorg/radare2

Use After Free in radareorg/radare2

Heap-based Buffer Overflow in radareorg/radare2

Radare2: command injection via pebble application files in radare2

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2

radare2 Command Injection via DWARF Parameter Names

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()

Out-of-bounds Read in radareorg/radare2

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.

In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.

In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.

In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.

In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.

Heap-based Buffer Overflow in radareorg/radare2

Use After Free in op_is_set_bp in radareorg/radare2

Access of Uninitialized Pointer in radareorg/radare2

Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2

Improper Validation of Array Index in radareorg/radare2

Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2

Integer Overflow or Wraparound in radareorg/radare2

radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow

radareorg radare2 Memory64ListStream mdmp.c stack-based overflow

radare2 < 6.1.4 Project Notes Path Traversal via Symlink