Home

Description

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.

PUBLISHED Reserved 2026-05-15 | Published 2026-05-15 | Updated 2026-05-15 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-416 Use After Free

Product status

Default status
affected

6.1.5 (semver)
affected

c213ad6894a1eb9086ac8bf5fae35757e9e1683c (git)
unaffected

Credits

Saad Elharaj finder

References

github.com/radareorg/radare2/issues/25836 issue-tracking

github.com/...ommit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c patch

www.vulncheck.com/...dare2-use-after-free-via-gdbr-pids-list third-party-advisory

cve.org (CVE-2026-8696)

nvd.nist.gov (CVE-2026-8696)

Download JSON