CVE-2026-8695: radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory cor

CVE-2026-8695 · Severity: high · CVSS 7.5 · Published 2026-05-15

Technologies: Radare2. Vendors: Radare.

Executive brief

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing.

Affected products

radare radare2

Related threats

radare2 infinite loop in NE relocation parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser
radare2 PEF loader denial of service
radare2 heap out-of-bounds read in ELF PN_XNUM handling