CVE-2026-8695

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Use After Free pada radare2. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing.

Rincian

Terbit di NVD

15 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/radareorg/radare2/commit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c patch
• https://www.vulncheck.com/advisories/radare2-use-after-free-via-gdbr-threads-list advisory pihak ketiga
• https://github.com/radareorg/radare2/issues/25835 exploit · issue tracking
• https://github.com/radareorg/radare2/issues/25836 exploit · issue tracking