Executive brief
radare2 is a popular open-source framework used by security researchers for reverse engineering and analyzing software. A vulnerability was found that could cause the program to crash when loading certain files if specific commands are executed during the loading process. This issue primarily affects the stability of the tool during local analysis sessions.
Technical details
A use-after-free (UAF) vulnerability exists in the r_core_bin_load function within libr/core/cfile.c of radare2. The flaw is triggered when the 'cmd.load' configuration is set to a command that closes the current IO descriptor (such as 'o-.') while the loader is still using a cached pointer to that descriptor. This results in a heap-use-after-free read, as confirmed by AddressSanitizer (ASan). An attacker or a specially crafted environment can exploit this locally to cause a crash. The issue has been addressed in commit 635ab1eeb30340c26076722a90cb91fb2272130b.
Affected products
- radareorg radare2 up to 6.1.6
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-07-06: advisory: NVD publication date
- 2026-07-05: patched: Fix committed to repository