CVE-2022-1714
Out-of-bounds Read in radareorg/radare2
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds Read in radareorg/radare2
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1714- CVSS 3.0
- 7.9 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2022-24997
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
EUVD-2022-24997- CVSS 3.0
- 7.9 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6cm-wgmg-cc45
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes...
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
GHSA-p6cm-wgmg-cc45- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-122, CWE-125, CWE-787
- Updated
- 2026-11-02
NVD
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1714- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.9 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-1714
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
ALPINE-CVE-2022-1714- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
OSV
Out-of-bounds Read in radareorg/radare2
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
CVE-2022-1714- CVSS 3.0
- 7.9 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-1714
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
- Record
UBUNTU-CVE-2022-1714- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.9 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12173-1 No score
radare2-5.7.0-1.1 on GA media
These are all security issues fixed in the radare2-5.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12173-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
radare2Alpine:v3.18 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.19 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.20 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.21 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.22 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.23 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.24 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Ubuntu:16.04:LTS |
All versions, plus listed versions 0.9.6-3.1ubuntu1 |
None known |
radare2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.6.0+dfsg-12.0.0+dfsg-12.1.0+dfsg-12.3.0+dfsg-12.3.0+dfsg-22.3.0+dfsg-2ubuntu0.1~esm1 |
None known |
radare2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.2.1+dfsg-5build14.0.0+dfsg-14.2.1+dfsg-14.2.1+dfsg-24.2.1+dfsg-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
radare2Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.5.0+dfsg-1ubuntu15.5.0+dfsg-1.1ubuntu25.5.0+dfsg-1.1ubuntu35.5.0+dfsg-1.1ubuntu3+esm1 |
None known |
radare2Ubuntu:25.10 |
All versions, plus listed versions 5.9.8+dfsg-25.9.8+dfsg-2ubuntu0.25.10.15.9.8+dfsg-2ubuntu0.25.10.2 |
None known |
radare2Ubuntu:26.10 |
All versions, plus listed versions 6.0.7+ds-16.1.6+ds-26.1.6+ds-36.1.8+ds-1 |
None known |
radare2Ubuntu:26.04:LTS |
All versions, plus listed versions 5.9.8+dfsg-26.0.4+dfsg-16.0.7+ds-1 |
None known |
radare2openSUSE:Tumbleweed From an advisory covering 38 CVEs |
before 5.7.0-1.1 | 5.7.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1714 is a high vulnerability (CVSS 7.9) in Radare Radare2, published May 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in radare2 5.7.0-r0.
References
huntr.dev/bounties/1c22055b-b015-47a8-a57b-4982978751d0
github.com/radareorg/radare2/commit/3ecdbf8e21186a9c5a4d3cfa3b1e9fd27045340e
nvd.nist.gov/vuln/detail/CVE-2022-1714
security.alpinelinux.org/vuln/CVE-2022-1714
Show 41 moreShow less
ubuntu.com/security/CVE-2022-1714
cve.org/CVERecord?id=CVE-2022-1714
suse.com/security/cve/CVE-2022-0139