radare2 6.1.5 Use-After-Free via gdbr_pids_list()

radare2 6.1.5 Use-After-Free via gdbr_threads_list()

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9

Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields

An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h

An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection

Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function

A double free issue was discovered in radare2 in cmd_info.c:cmd_info()

Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0

Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8

Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0

radareorg radare2 Memory64ListStream mdmp.c stack-based overflow

radareorg radare2 cfile.c r_core_bin_load use after free

radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow

radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free

radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow

radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow

radare2 < 6.1.4 Project Notes Path Traversal via Symlink

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

radare2 Command Injection via DWARF Parameter Names

radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2

Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0

Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0

Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8

Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8

Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2

Use After Free in NPM radare2.js prior to 5.6.2

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write

In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c

In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context

In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c

There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file

There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file

The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file

In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an…