Description
Out-of-bounds Write vulnerability in radareorg radare2 allows
heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| radareorg | radare2 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | radare2 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | radare2 | 5.9.8-bp156.4.9.1 | openSUSE-SU-2025:0101-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | radare2 | 5.9.8-3.1 | openSUSE-SU-2025:15292-1 |
| openSUSE Leap 15.6 | radare2 | 5.9.8-bp156.4.9.1 | openSUSE-SU-2025:0101-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | binutils | 2.41-5 | — |
| Azure Linux 3 | ceph | 18.2.2-6 | — |
| Azure Linux 3 | fltk +3 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | binutils | 2.37-14 | — |
| Azure Linux 2 (CBL-Mariner) | ceph | 16.2.10-7 | — |
| Azure Linux 2 (CBL-Mariner) | cloud-hypervisor | 32.0-6 | — |
| Azure Linux 2 (CBL-Mariner) | fltk +3 | No fix yet | — |
Advisories 2
- openSUSE-SU-2025:15292-1 radare2-5.9.8-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:0101-1 Security update for radare2 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/radareorg/radare2/pull/23969 patch third-party-advisory