Executive brief
radare2 is a popular open-source framework used by security researchers for reverse engineering and analyzing software. A flaw was discovered where the tool could crash or behave unexpectedly when processing specific disassembly commands that change architecture settings. This could allow a local user to cause a denial-of-service condition on the system where the analysis is being performed.
Technical details
A use-after-free (UAF) vulnerability exists in radare2's 'pde' disassembly path within libr/core/disasm.c. The issue occurs in the r_core_seek_arch_bits function when a bitness hint (e.g., 'ahb') triggers a reset of the analysis register profile while the disassembly loop is still active. This causes the application to reference a previously freed PC register item in subsequent iterations, specifically within r_reg_get_value. An attacker with local access can exploit this by providing a specially crafted script or command sequence to trigger the crash. A patch has been released in commit 8b25c773785d85cb0103410a0905089d286921c2.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-07-05: advisory: CVE published to NVD
- 2026-07-05: patched: Patch commit identified