CVE-2022-1437
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1437- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2022-24747
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
EUVD-2022-24747- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6c8c-qvc7-64g8
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes...
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
GHSA-6c8c-qvc7-64g8- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1437- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-1437
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
ALPINE-CVE-2022-1437- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
OSV
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1437- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-1437
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
UBUNTU-CVE-2022-1437- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12173-1 No score
radare2-5.7.0-1.1 on GA media
These are all security issues fixed in the radare2-5.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12173-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
radare2Alpine:v3.18 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.19 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.20 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.21 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.22 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.23 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.24 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Ubuntu:16.04:LTS |
All versions, plus listed versions 0.9.6-3.1ubuntu1 |
None known |
radare2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.6.0+dfsg-12.0.0+dfsg-12.1.0+dfsg-12.3.0+dfsg-12.3.0+dfsg-22.3.0+dfsg-2ubuntu0.1~esm1 |
None known |
radare2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.2.1+dfsg-5build14.0.0+dfsg-14.2.1+dfsg-14.2.1+dfsg-24.2.1+dfsg-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
radare2Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.5.0+dfsg-1ubuntu15.5.0+dfsg-1.1ubuntu25.5.0+dfsg-1.1ubuntu35.5.0+dfsg-1.1ubuntu3+esm1 |
None known |
radare2Ubuntu:25.10 |
All versions, plus listed versions 5.9.8+dfsg-25.9.8+dfsg-2ubuntu0.25.10.15.9.8+dfsg-2ubuntu0.25.10.2 |
None known |
radare2Ubuntu:26.10 |
All versions, plus listed versions 6.0.7+ds-16.1.6+ds-26.1.6+ds-36.1.8+ds-1 |
None known |
radare2Ubuntu:26.04:LTS |
All versions, plus listed versions 5.9.8+dfsg-26.0.4+dfsg-16.0.7+ds-1 |
None known |
radare2openSUSE:Tumbleweed From an advisory covering 38 CVEs |
before 5.7.0-1.1 | 5.7.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1437 is a medium vulnerability (CVSS 5.3) in Radare Radare2, published April 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in radare2 5.7.0-r0.
References
huntr.dev/bounties/af6c3e9e-b7df-4d80-b48f-77fdd17b4038
github.com/radareorg/radare2/commit/669a404b6d98d5db409a5ebadae4e94b34ef5136
nvd.nist.gov/vuln/detail/CVE-2022-1437
security.alpinelinux.org/vuln/CVE-2022-1437
Show 40 moreShow less
ubuntu.com/security/CVE-2022-1437
cve.org/CVERecord?id=CVE-2022-1437
suse.com/security/cve/CVE-2022-0139