Executive brief
radare2 is a popular open-source framework used by security researchers and developers for reverse engineering and analyzing software. A vulnerability in its analysis engine allows a local user to trigger an integer overflow by providing a specially crafted command. This could lead to unexpected program behavior, potential data corruption, or a crash, impacting the reliability of the analysis environment.
Technical details
A signed integer overflow exists in the 'core_anal_bytes' function within 'libr/core/cmd_anal.inc.c'. The vulnerability is triggered when the 'aos' command is provided with a large integer argument (e.g., 268435456), which is subsequently multiplied by 8 without proper bounds checking. This multiplication results in a value that cannot be represented in a standard 32-bit signed integer, leading to undefined behavior as detected by UndefinedBehaviorSanitizer (UBSan). An attacker with local access to the radare2 CLI can exploit this to cause a crash or potentially manipulate the program's execution flow. Users are advised to apply the latest patches from the radareorg repository.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub repository
- 2026-07-05: advisory: NVD publication date