What’s Vulnerable › Products
radareorg/radare2 vulnerabilities
181 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 47 published in the last 12 months.
Check whether your radareorg/radare2 version is affected
Latest radareorg/radare2 vulnerabilities
- CVE-2026-112077 — radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism (CVSS 5.6)
- CVE-2026-81886 — radare2: Uncontrolled memory allocation in radare2 dmp64 parser (CVSS 5.5)
- CVE-2026-81885 — radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSS 5.5)
- CVE-2026-81884 — radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser (CVSS 3.3)
- CVE-2026-81883 — radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode (CVSS 3.3)
- CVE-2026-81882 — radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser (CVSS 6.1)
- CVE-2026-81881 — radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser (CVSS 4.4)
- CVE-2026-81880 — radare2: Uncontrolled resource consumption in radare2 PEF loader (CVSS 5.5)
- CVE-2026-81879 — radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling (CVSS 6.1)
- CVE-2026-81878 — radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser (CVSS 5.5)
- CVE-2026-14789 — radareorg radare2 Memory64ListStream mdmp.c stack-based overflow (CVSS 7.8)
- CVE-2026-14788 — radareorg radare2 cfile.c r_core_bin_load use after free (CVSS 7.8)
- CVE-2026-14787 — radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow (CVSS 7.8)
- CVE-2026-14786 — radareorg radare2 str.c r_str_word_get0set integer overflow (CVSS 5.5)
- CVE-2026-14761 — radareorg radare2 str.c r_str_append integer overflow (CVSS 5.5)
- CVE-2026-14760 — radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free (CVSS 7.8)
- CVE-2026-14759 — radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow (CVSS 7.8)
- CVE-2026-14758 — radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow (CVSS 5.5)
- CVE-2026-14757 — radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow (CVSS 7.8)
- CVE-2026-8696 — radare2 6.1.5 Use-After-Free via gdbr_pids_list() (CVSS 9.8)
- CVE-2026-8695 — radare2 6.1.5 Use-After-Free via gdbr_threads_list() (CVSS 9.8)
- CVE-2026-6941 — radare2 < 6.1.4 Project Notes Path Traversal via Symlink (CVSS 7.8)
- CVE-2026-6940 — radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion (CVSS 7.1)
- CVE-2026-40517 — radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names (CVSS 7.8)
- CVE-2026-40527 — radare2 Command Injection via DWARF Parameter Names (CVSS 7.8)