Attack Chain

1. Attacker establishes a GDB remote debugging connection to the target radare2 instance.
2. Attacker sends a valid qfThreadInfo request to initiate thread list retrieval.
3. The radare2 instance processes the qfThreadInfo request and prepares the initial thread list.
4. Attacker sends a malformed qsThreadInfo request as a continuation of thread list retrieval.
5. The gdbr_threads_list() function attempts to process the malformed qsThreadInfo response.
6. Due to the malformed data, the function accesses a previously freed memory location.
7. This use-after-free condition triggers memory corruption.
8. Depending on the memory layout and attacker-controlled data, this can lead to a denial of service (application crash) or potentially code execution.

Impact

Successful exploitation of CVE-2026-8695 can result in a denial-of-service condition, where the radare2 application crashes, interrupting debugging or analysis tasks. In more sophisticated scenarios, attackers could potentially achieve arbitrary code execution by carefully manipulating the memory corruption caused by the use-after-free vulnerability. The impact is greatest in environments where radare2 is used to analyze potentially malicious binaries, as the attacker could leverage this vulnerability to compromise the analysis system.

Recommendation

• Upgrade to a version of radare2 that patches CVE-2026-8695.
• Monitor network connections for unusual GDB debugging traffic using the Detect Malformed GDB Thread Info Request Sigma rule.
• Consider restricting access to GDB debugging interfaces to trusted networks or users.
• Review the provided references (especially the VulnCheck advisory) for more context on the exploitation details for CVE-2026-8695.