Executive brief
radare2 is a popular open-source framework used by security researchers and developers for reverse engineering and analyzing binary files. A vulnerability was found in its print command handler where providing an excessively large length value can cause the application to crash. This could be used by an attacker to disrupt the analysis process or cause a denial-of-service on the local system where the tool is running.
Technical details
An integer overflow vulnerability exists in radare2 versions up to 6.1.6 within the `cmd_print` function located in `libr/core/cmd_print.inc.c`. The flaw occurs when the `pb` (print bit) command processes a user-supplied length value; specifically, the application performs a multiplication (`len * 8`) using a signed integer without proper bounds checking. If a sufficiently large value (e.g., 0x10000000) is provided, it triggers a signed integer overflow, which can lead to undefined behavior or a crash (Denial of Service). This is a local attack requiring the ability to execute commands within the radare2 environment. A patch has been developed that introduces length validation to ensure the value does not exceed `ST32_MAX / 8`.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-07-06: advisory: NVD publication date
- 2026-07-06: patched: Commit 2b6265476c75567006b0fcbb749f4ae7b189c5df released