CVE-2023-47016

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a...

7.5 HighFix available

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.19%Up 1.1 points since Nov 22, 2023

What each source reports

NVD Score used 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: CVE-2023-47016
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE List 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: CVE-2023-47016
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2023-51173 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: EUVD-2023-51173
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xqp4-mm4v-p6r4 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a...

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: GHSA-xqp4-mm4v-p6r4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: CVE-2023-47016
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-47016 7.5

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Record: UBUNTU-CVE-2023-47016
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2024-0298 No score

Updated radare2 packages fix security vulnerability

radare2 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian

Record: MGASA-2024-0298
Updated: 2026-11-02

Affected products

radare radare2

Affected packages

Affected packages
Package	Affected	Fixed
`radare2` Mageia:9	before 5.8.8-1.2.mga9	5.8.8-1.2.mga9
`radare2` Ubuntu:16.04:LTS	All versions, plus listed versions 0.9.6-3.1ubuntu1	None known
`radare2` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.6.0+dfsg-12.0.0+dfsg-12.1.0+dfsg-12.3.0+dfsg-12.3.0+dfsg-22.3.0+dfsg-2ubuntu0.1~esm1	None known
`radare2` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.2.1+dfsg-5build14.0.0+dfsg-14.2.1+dfsg-14.2.1+dfsg-24.2.1+dfsg-2ubuntu0.1~esm1	None known
`radare2` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 5.5.0+dfsg-1ubuntu15.5.0+dfsg-1.1ubuntu25.5.0+dfsg-1.1ubuntu35.5.0+dfsg-1.1ubuntu3+esm1	None known
`radare2` Ubuntu:25.10	All versions, plus listed versions 5.9.8+dfsg-25.9.8+dfsg-2ubuntu0.25.10.15.9.8+dfsg-2ubuntu0.25.10.2	None known
`radare2` Ubuntu:26.10	All versions, plus listed versions 6.0.7+ds-16.1.6+ds-26.1.6+ds-36.1.8+ds-1	None known
`radare2` Ubuntu:26.04:LTS	All versions, plus listed versions 5.9.8+dfsg-26.0.4+dfsg-16.0.7+ds-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-47016 is a high vulnerability (CVSS 7.5) in Radare Radare2, published November 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in radare2 5.8.8-1.2.mga9.

References

Show 5 moreShow less