Every CVE Search/ Get API key

CVE-2021-44974

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p...

5.5 MediumFix available

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.89%Unchanged since May 26, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
CVE-2021-44974
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
CVE-2021-44974
Updated
2026-11-02
EUVDEUVD-2021-31772 No score

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
EUVD-2021-31772
Updated
2026-11-03
GitHub AdvisoriesGHSA-7m75-j44m-f9x9 5.5

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p...

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
GHSA-7m75-j44m-f9x9
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2021-44974 5.5

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
ALPINE-CVE-2021-44974
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.5

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
CVE-2021-44974
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44974 5.5

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.

Record
UBUNTU-CVE-2021-44974
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2022-0440 No score

Updated radare2/rizin packages fix security vulnerability

In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS. (CVE-2021-32613)

A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS. (CVE-2021-3673)

A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS. (CVE-2021-4021)

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser. (CVE-2021-44974)

radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser. (CVE-2021-44975)

radare2 is vulnerable to Out-of-bounds Read. (CVE-2022-0173)

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0. (CVE-2022-0419)

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. (CVE-2022-0476)

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2. (CVE-2022-0518)

Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2. (CVE-2022-0519)

Use After Free in NPM radare2.js prior to 5.6.2. (CVE-2022-0520)

Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2. (CVE-2022-0521)

Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2. (CVE-2022-0522)

Expired Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.2. (CVE-2022-0523)

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. (CVE-2022-0559)

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. (CVE-2022-0676)

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. (CVE-2022-0695)

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4. (CVE-2022-0712)

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. (CVE-2022-0713)

Record
MGASA-2022-0440
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
radare2
Alpine:v3.18
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.19
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.20
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.21
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.22
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.23
before 5.5.4-r0
5.5.4-r0
radare2
Alpine:v3.24
before 5.5.4-r0
5.5.4-r0
radare2
Mageia:8
From an advisory covering 19 CVEs
before 5.6.4-1.mga8
5.6.4-1.mga8
radare2-cutter
Mageia:8
From an advisory covering 19 CVEs
before 2.0.4-2.mga8
2.0.4-2.mga8
rizin
Mageia:8
From an advisory covering 19 CVEs
before 0.3.1-1.mga8
0.3.1-1.mga8
Show 7 moreShow less
Affected packages
PackageAffectedFixed
radare2
Ubuntu:16.04:LTS
All versions, plus listed versions
0.9.6-3.1ubuntu1
None known
radare2
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.6.0+dfsg-12.0.0+dfsg-12.1.0+dfsg-12.3.0+dfsg-12.3.0+dfsg-22.3.0+dfsg-2ubuntu0.1~esm1
None known
radare2
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
3.2.1+dfsg-5build14.0.0+dfsg-14.2.1+dfsg-14.2.1+dfsg-24.2.1+dfsg-2ubuntu0.1~esm1
None known
radare2
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
5.5.0+dfsg-1ubuntu15.5.0+dfsg-1.1ubuntu25.5.0+dfsg-1.1ubuntu35.5.0+dfsg-1.1ubuntu3+esm1
None known
radare2
Ubuntu:25.10
All versions, plus listed versions
5.9.8+dfsg-25.9.8+dfsg-2ubuntu0.25.10.15.9.8+dfsg-2ubuntu0.25.10.2
None known
radare2
Ubuntu:26.10
All versions, plus listed versions
6.0.7+ds-16.1.6+ds-26.1.6+ds-36.1.8+ds-1
None known
radare2
Ubuntu:26.04:LTS
All versions, plus listed versions
5.9.8+dfsg-26.0.4+dfsg-16.0.7+ds-1
None known

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44974 is a medium vulnerability (CVSS 5.5) in Radare Radare2, published May 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in radare2 5.5.4-r0.

References

Show 8 moreShow less
MoveEnter Open