Skip to content
Threat Feed
Subscribe

Vendor

Radare

3 briefs RSS
high advisory

radare2 Use-After-Free Vulnerability in gdbr_threads_list() Function (CVE-2026-8695)

radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function, allowing remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response, potentially leading to denial of service or code execution through GDB remote debugging (CVE-2026-8695).

radare2 use-after-free memory-corruption gdb debugging
1r 3t 1c
high advisory

Radare2 Path Traversal Vulnerability in Project Deletion

Radare2 versions prior to 6.1.4 are vulnerable to a path traversal in project deletion, allowing local attackers to recursively delete arbitrary directories by escaping the 'dir.projects' root, leading to integrity and availability loss.

radare2 path-traversal local-privilege-escalation
2r 1t 1c
high advisory

radare2 PDB Parser Command Injection Vulnerability (CVE-2026-40517)

A command injection vulnerability exists in radare2 versions prior to 6.1.4, where a crafted PDB file with newline characters in symbol names can inject arbitrary radare2 commands, leading to arbitrary OS command execution.

radare2 command-injection CVE-2026-40517
2r 1t 1c