CVE-2025-60358
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations.
Risk Assessment
The memory leak can lead to gradual resource exhaustion during long analysis of malicious or malformed files, causing instability or crashes of the tool.
Recommendation
Update radare2 to a version later than 5.9.8 that contains the memory leak fix.
Other vulnerabilities in radare2
See all- CVE-2026-8696High
Version 6.1.5 of radare2 contains a use-after-free vulnerability in the gdbr_pids_list() function, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses.
- CVE-2026-8695High
radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.
- CVE-2017-15932High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in elf.c, which can be triggered by crafted ELF files when parsing the ELF version on 32-bit systems.
- CVE-2017-15931High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in elf.c, which can be exploited via crafted ELF files on 32-bit systems.
- CVE-2017-15385High
The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.
- CVE-2017-15368High
The wasm_dis function in radare2 version 2.0.0 allows remote attackers to cause denial of service through stack-based buffer over-read, leading to application crash. The attack can be executed using a crafted WASM file that triggers an incorrect r_hex_bin2str call.
- CVE-2017-10929High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.
- CVE-2017-9949High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service via a crafted binary file, potentially leading to application crashes due to a buffer underflow.
- CVE-2017-6448High
The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
- CVE-2017-6194High
The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
Original NVD description (English source)
radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS