Executive brief
A security vulnerability exists in radare2, a popular open-source reverse engineering framework. The flaw occurs when the software handles extremely long text strings, which can cause it to crash or behave unexpectedly. While an attacker would need local access to the system to exploit this, it could disrupt operations for developers and security researchers using the tool.
Technical details
A signed integer overflow vulnerability exists in the r_str_ndup and r_str_append functions within libr/util/str.c of radare2. The issue stems from using signed integers to calculate string lengths and memory allocation sizes; specifically, computing a size of 2147483647 + 1 leads to undefined behavior and potential crashes. An attacker with local access can trigger this overflow by providing specially crafted inputs that exceed the supported integer range during string concatenation. The vulnerability has been addressed in commit a20a56917ae85d732e683f8d9078bdcfee92446c by implementing checked size arithmetic.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub by Bin-infinite
- 2026-07-05: advisory: NVD/VulDB advisory published
- 2026-07-05: patched: Patch identifier a20a56917ae85d732e683f8d9078bdcfee92446c disclosed