Executive brief
Rizin is an open-source toolset used by security researchers and developers to analyze and reverse-engineer software. A vulnerability in how it handles certain object file formats could allow a specially crafted file to cause the program to read memory it shouldn't. While this primarily poses a minor risk of information disclosure during a technical analysis session, it could potentially lead to a crash or be used in conjunction with other flaws.
Technical details
An out-of-bounds read vulnerability exists in the Object Module Format (OMF) parser of Rizin, specifically within `librz/bin/format/omf/omf.c`. The flaw is caused by an incorrect bounds check where a segment index (`seg_idx - 1`) was compared using a greater-than operator instead of greater-than-or-equal-to against the section count (`nb_section`). This off-by-one error allows an attacker to provide a malicious OMF binary that triggers a read past the end of the allocated section array when processing the `_start` symbol. Exploitation requires a user to open a specially crafted OMF file. The issue has been patched in commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.
Affected products
- rizinorg Rizin dev < e6d0937c8a083e23ed76ccfb9f631cdc50c7af47
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date