CVE-2025-60359
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new. The leak may lead to gradual memory consumption during long-term use.
Risk Assessment
A memory leak can cause resource exhaustion and application or system crash. This may lead to denial of service.
Recommendation
Update radare2 to a version newer than 5.9.8. Monitor memory usage when working with radare2.
Other vulnerabilities in radare2
See all- CVE-2026-8696High
Version 6.1.5 of radare2 contains a use-after-free vulnerability in the gdbr_pids_list() function, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses.
- CVE-2026-8695High
radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.
- CVE-2017-15932High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in elf.c, which can be triggered by crafted ELF files when parsing the ELF version on 32-bit systems.
- CVE-2017-15931High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in elf.c, which can be exploited via crafted ELF files on 32-bit systems.
- CVE-2017-15385High
The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.
- CVE-2017-15368High
The wasm_dis function in radare2 version 2.0.0 allows remote attackers to cause denial of service through stack-based buffer over-read, leading to application crash. The attack can be executed using a crafted WASM file that triggers an incorrect r_hex_bin2str call.
- CVE-2017-10929High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.
- CVE-2017-9949High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service via a crafted binary file, potentially leading to application crashes due to a buffer underflow.
- CVE-2017-6448High
The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
- CVE-2017-6194High
The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
Original NVD description (English source)
radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS