Executive brief
A vulnerability was found in radare2, a popular open-source reverse engineering framework. An attacker with local access to the system could provide specially crafted input to the tool's hexpairs parser, causing the application to crash. This issue primarily impacts the reliability and availability of the tool during security analysis tasks.
Technical details
An integer overflow vulnerability exists in radare2 versions up to 6.1.6 within the `cmd_anal_opcode` function in `libr/core/cmd_anal.inc.c`. The flaw is located in the hexpairs parser component, where improper handling of large repeat counts (e.g., in format strings like `[2147483647]X`) leads to a signed integer overflow when updating the current index. An attacker can exploit this by providing a crafted format string to the `pf2` command or related analysis functions. This results in undefined behavior or a crash (Denial of Service). The issue has been addressed in commit 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 by adding bounds checking for the opcode count.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-07-05: advisory: CVE published to NVD