Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8

radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser

radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8

radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2: Uncontrolled memory allocation in radare2 dmp64 parser

radare2: Uncontrolled resource consumption in radare2 PEF loader

radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser

radareorg radare2 str.c r_str_word_get0set integer overflow

radareorg radare2 str.c r_str_append integer overflow

radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow

A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c

radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new

radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init

radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations

An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function

An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub_sfs_read_extent function

radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c

Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c

Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser

radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser

Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0

heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8

heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8

NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8

heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8

Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6

Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0

radare2 is vulnerable to Out-of-bounds Read

In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS

radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section

In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command

In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a…

In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer…

In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by…

In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds…

In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds…

In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a…

In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer…

opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2

getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as…

In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file

The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application…

The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)…