CVE-2022-1451
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
CVE-2022-1451- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-788
- Updated
- 2026-11-02
EUVDEUVD-2022-24757
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
EUVD-2022-24757- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c72r-87h5-77h5
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg...
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
GHSA-c72r-87h5-77h5- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
CVE-2022-1451- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-788, CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-1451
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
ALPINE-CVE-2022-1451- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
OSV
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
CVE-2022-1451- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-788
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-1451
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see CWE-125: Out-of-bounds read.
- Record
UBUNTU-CVE-2022-1451- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12173-1 No score
radare2-5.7.0-1.1 on GA media
These are all security issues fixed in the radare2-5.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12173-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
radare2Alpine:v3.18 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.19 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.20 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.21 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.22 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.23 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Alpine:v3.24 |
before 5.7.0-r0 | 5.7.0-r0 |
radare2Ubuntu:16.04:LTS |
All versions, plus listed versions 0.9.6-3.1ubuntu1 |
None known |
radare2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.6.0+dfsg-12.0.0+dfsg-12.1.0+dfsg-12.3.0+dfsg-12.3.0+dfsg-22.3.0+dfsg-2ubuntu0.1~esm1 |
None known |
radare2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.2.1+dfsg-5build14.0.0+dfsg-14.2.1+dfsg-14.2.1+dfsg-24.2.1+dfsg-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
radare2Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.5.0+dfsg-1ubuntu15.5.0+dfsg-1.1ubuntu25.5.0+dfsg-1.1ubuntu35.5.0+dfsg-1.1ubuntu3+esm1 |
None known |
radare2Ubuntu:25.10 |
All versions, plus listed versions 5.9.8+dfsg-25.9.8+dfsg-2ubuntu0.25.10.15.9.8+dfsg-2ubuntu0.25.10.2 |
None known |
radare2Ubuntu:26.10 |
All versions, plus listed versions 6.0.7+ds-16.1.6+ds-26.1.6+ds-36.1.8+ds-1 |
None known |
radare2Ubuntu:26.04:LTS |
All versions, plus listed versions 5.9.8+dfsg-26.0.4+dfsg-16.0.7+ds-1 |
None known |
radare2openSUSE:Tumbleweed From an advisory covering 38 CVEs |
before 5.7.0-1.1 | 5.7.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1451 is a high vulnerability (CVSS 7.1) in Radare Radare2, published April 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in radare2 5.7.0-r0.
References
huntr.dev/bounties/229a2e0d-9e5c-402f-9a24-57fa2eb1aaa7
github.com/radareorg/radare2/commit/0927ed3ae99444e7b47b84e43118deb10fe37529
nvd.nist.gov/vuln/detail/CVE-2022-1451
security.alpinelinux.org/vuln/CVE-2022-1451
Show 40 moreShow less
ubuntu.com/security/CVE-2022-1451
cve.org/CVERecord?id=CVE-2022-1451
suse.com/security/cve/CVE-2022-0139