Radare vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-41015 radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP.High 7.4 · Apr 15, 2026
• CVE-2024-29646 Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.Critical 9.8 · Dec 17, 2024
• CVE-2024-11858 A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files.High 8.6 · Dec 15, 2024
• CVE-2024-29645 Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function.High 7.8 · Dec 2, 2024
• CVE-2023-47016 radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.High 7.5 · Nov 22, 2023
• CVE-2023-46570 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.Critical 9.8 · Oct 27, 2023
• CVE-2023-46569 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.Critical 9.8 · Oct 27, 2023
• CVE-2022-28073 A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2022-28072 A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2022-28071 A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2022-28070 A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2022-28069 A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2022-28068 A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.High 7.5 · Aug 22, 2023
• CVE-2020-27795 A segmentation fault was discovered in radare2 with adf command.High 7.5 · Aug 19, 2022
• CVE-2020-27794 A double free issue was discovered in radare2 in cmd_info.c:cmd_info().Critical 9.1 · Aug 19, 2022
• CVE-2020-27793 An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c.High 7.5 · Aug 19, 2022
• CVE-2021-4021 A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2.High 7.5 · Feb 24, 2022
• CVE-2021-3673 A vulnerability was found in Radare2 in version 5.3.1.High 7.5 · Aug 2, 2021
• CVE-2020-24133 A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carrCritical 9.8 · Jul 14, 2021
• CVE-2020-17487 radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c.High 7.5 · Aug 11, 2020
• CVE-2019-19647 radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write.High 7.8 · Dec 8, 2019
• CVE-2019-19590 In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c.High 7.8 · Dec 4, 2019
• CVE-2019-16718 In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c.High 7.8 · Sep 23, 2019
• CVE-2019-14745 In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c.High 7.8 · Aug 7, 2019
• CVE-2019-12829 radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified othHigh 7.5 · Jun 15, 2019