TI-2022-00443 Aliases CVE-2022-0523 GHSA-g7mg-6rh4-c572

Use After Free in radareorg/radare2

LOW 36CWE-416Published 2022-02-08 · Updated 2024-08-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

Why it matters now

EPSS 0.01092 65th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed radareorg/radare2 (radareorg): 5.6.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
radareorg	radareorg/radare2	before 5.6.2	5.6.2	Patch available	CNA

radareorg/radare2 Vendorradareorg Affected before 5.6.2 Fixed in 5.6.2 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:radare:radare2::::::::	before 5.6.2	Vulnerable	radareorg
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:::::::*	36	Vulnerable	Fedoraproject

cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:* Versions before 5.6.2 Vulnerable ·radareorg
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Fix · CNA radareorg/radare2 (radareorg) Fixed in 5.6.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-02-08
radareorg/radare2 5.6.2
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2022-00440 Use After Free in radareorg/radare2Priority LOW 36
- TI-2022-00442 Access of Memory Location Before Start of Buffer in radareorg/radare2Priority LOW 33
- TI-2022-00441 Access of Memory Location After End of Buffer in radareorg/radare2Priority LOW 33
Show all 6 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-0523
2026-10-03 Alias added: GHSA-g7mg-6rh4-c572

References

Exploit 1

https://huntr.dev/bounties/9d8d6ae0-fe00-40b9-ae1e-b0e8103bac69

Patch 1

https://github.com/radareorg/radare2/commit/35482cb760db10f87a62569e2f8872dbd95e9269

Advisory 2

TI-2023-25089 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function… CVSS 3.1CRITICAL 9.8
TI-2023-25088 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu… CVSS 3.1CRITICAL 9.8
TI-2021-12172 Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. CVSS 3.1CRITICAL 10.0
TI-2026-07640 radare2 6.1.5 Use-After-Free via gdbr_pids_list() CVSS 4.0HIGH 8.7
TI-2026-07639 radare2 6.1.5 Use-After-Free via gdbr_threads_list() CVSS 4.0HIGH 8.7
TI-2023-03993 Heap-based Buffer Overflow in radareorg/radare2 CVSS 3.1CRITICAL 9.8

See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences