Low severity · published Feb 17, 2025
CVE-2025-1378
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286
3.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Radare2 · Radare
5.9.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1378
Patch
https://github.com/radareorg/radare2/commit/c6c772d2eab692ce7ada5a4227afd50c355ad545
Exploit
https://github.com/radareorg/radare2/issues/23953
Exploit
https://github.com/radareorg/radare2/issues/23953#issue-2844325926
Release Notes
https://github.com/radareorg/radare2/milestone/86
Permissions Required
https://vuldb.com/?ctiid.295986
Third Party Advisory
https://vuldb.com/?id.295986
More from Radare2
9.8
CVE-2026-8696
radare2 6.1.5 Use-After-Free via gdbr_pids_list()
9.8
CVE-2026-8695
radare2 6.1.5 Use-After-Free via gdbr_threads_list()
9.8
CVE-2025-1864
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9
9.8
CVE-2025-1744
Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9
9.8
CVE-2024-29646
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields