{"id":"CVE-2025-1744","aliases":["AZL-57501","AZL-57512","AZL-57518","AZL-57521","AZL-57524","AZL-57528","AZL-57533","AZL-57590","AZL-57629","AZL-57633","AZL-57636","AZL-57639","AZL-57644","EUVD-2025-5478","GHSA-mqpp-c67f-qr4v","MGASA-2025-0116","UBUNTU-CVE-2025-1744","openSUSE-SU-2025:0101-1","openSUSE-SU-2025:15292-1","openSUSE-SU-2026:20653-1"],"status":"published","title":"Out-of-bounds Write in radare2","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00507,"percentile":0.43567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-02-28T03:24:50Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"ceph","fixed_in":["18.2.2-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"binutils","fixed_in":["2.41-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"ceph","fixed_in":["16.2.10-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"binutils","fixed_in":["2.37-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cloud-hypervisor","fixed_in":["32.0-6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gpsbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"fltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.5-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.10-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gpsbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cloud-hypervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32.0-6"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.8-1.6.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.8+dfsg-2","5.9.8+dfsg-2ubuntu0.25.10.1","5.9.8+dfsg-2ubuntu0.25.10.2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.8-bp156.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.8-bp156.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.8-3.1"}]}],"bundled":3}],"products":[{"vendor":"radare","product":"radare2"},{"vendor":"radare2","product":"radare2"},{"vendor":"radareorg","product":"radare2"}],"references":[{"url":"https://github.com/radareorg/radare2/pull/23969","tags":["patch","third-party-advisory","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1744","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mqpp-c67f-qr4v"},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1744.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0116.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34122","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JESFQCNT2ONAGTVQXEDREBQFC7NUDPEC/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-1744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1744","tags":["report"]},{"url":"https://github.com/radareorg/radare2/commit/e64c606b1342a4c0ab2c35ef5146b69667dcd43a","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HIV7NQ4GTDLGOADVK37OYTIHBMTC3O3W/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238075","tags":["report"]},{"url":"https://bugzilla.suse.com/1238451","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1864","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5641","tags":["web"]},{"url":"https://bugzilla.suse.com/1234065","tags":["report"]},{"url":"https://bugzilla.suse.com/1237250","tags":["report"]},{"url":"https://bugzilla.suse.com/1244121","tags":["report"]},{"url":"https://bugzilla.suse.com/1262142","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40499","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-1744","title":"Out-of-bounds Write in radare2","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T03:24:50.301Z","modified":"2025-02-28T15:21:25.305Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-5478","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T03:24:50Z","modified":"2025-02-28T15:21:25Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T20:53:19.898689Z"}],"ghsa":[{"id":"GHSA-mqpp-c67f-qr4v","title":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or...","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T06:30:48Z","modified":"2025-07-01T15:32:06Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:02:52.793128Z"}],"nvd":[{"id":"CVE-2025-1744","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09.603Z","modified":"2026-06-17T08:39:42.087Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:10:52.398004Z"}],"osv":[{"id":"CVE-2025-1744","title":"Out-of-bounds Write in radare2","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T03:24:50.301Z","modified":"2026-10-28T02:30:27.750266942Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"UBUNTU-CVE-2025-1744","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:00Z","modified":"2026-09-21T04:45:03.709901248Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-57501","title":"CVE-2025-1744 affecting package ceph for versions less than 18.2.2-6","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57512","title":"CVE-2025-1744 affecting package gpsbabel 1.8.0-4","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:57.915289Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57518","title":"CVE-2025-1744 affecting package fltk 1.3.5-4","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:57.586248Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57521","title":"CVE-2025-1744 affecting package gdal 3.6.3-5","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:57.890595Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57524","title":"CVE-2025-1744 affecting package openjpeg2 2.3.1-12","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:57.434852Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57528","title":"CVE-2025-1744 affecting package binutils for versions less than 2.41-5","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57533","title":"CVE-2025-1744 affecting package ceph for versions less than 16.2.10-7","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:57.637021Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57590","title":"CVE-2025-1744 affecting package binutils for versions less than 2.37-14","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:58.232719Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57629","title":"CVE-2025-1744 affecting package fltk 1.3.8-1","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57633","title":"CVE-2025-1744 affecting package openjpeg2 2.3.1-12","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57636","title":"CVE-2025-1744 affecting package gpsbabel 1.8.0-4","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57639","title":"CVE-2025-1744 affecting package gdal 3.6.3-2","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57644","title":"CVE-2025-1744 affecting package cloud-hypervisor for versions less than 32.0-6","description":"Out-of-bounds Write vulnerability in radareorg radare2 allows \n\nheap-based buffer over-read or buffer overflow.This issue affects radare2: before \u003c5.9.9.","status":"published","published":"2025-02-28T04:15:09Z","modified":"2026-04-21T04:36:58.344646Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"MGASA-2025-0116","title":"Updated radare2 packages fix security vulnerabilities","description":"Buffer overflow in the HFS parser from grub2. (CVE-2024-56737)\nOut-of-bounds Write in radare2. (CVE-2025-1744)\nBuffer Overflow and Potential Code Execution in Radare2. (CVE-2025-1864)\n","status":"published","published":"2025-03-26T03:43:25Z","modified":"2026-04-16T04:43:32.572256654Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:0101-1","title":"Security update for radare2","description":"This update for radare2 fixes the following issues:\n\n- CVE-2025-1864: Fix buffer overflow and potential code execution. (boo#1238451)\n- CVE-2025-1744: Fix heap-based buffer over-read or buffer overflow. (boo#1238075)\n","status":"published","published":"2025-03-23T15:01:53Z","modified":"2026-02-04T02:15:00.612428Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15292-1","title":"radare2-5.9.8-3.1 on GA media","description":"These are all security issues fixed in the radare2-5.9.8-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.216406Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20653-1","title":"Security update for radare2","description":"This update for radare2 fixes the following issues:\n\nChanges in radare2:\n\n- Update to version 6.1.4 (bsc#1262142, CVE-2026-40499):\n  * Analysis: improve autoname scoring, jmptbl detection, and performance\n  * Add callargs modifier, rnum expressions, and typed function context\n  * Refactor autoname into plugin; extend RAnalPlugin hooks\n  * Fix leaks, overflows, and command injection in analysis scripts\n  * Improve string detection, wide strings, and switch/case analysis\n  * Arch: fix v850/nds32 ESIL, optimize to O(1), improve pseudo support\n  * Cache capstone options and improve multi-arch disassembly\n  * ASM: add camel syntax support, unify via RArch API\n  * Bin: major parser fixes (ELF, Mach-O, PE, DEX, PDB, WAD, XCOFF)\n  * Fix leaks, OOB reads/writes, overflows, and improve bounds checks\n  * Improve Swift demangling, ARM hints, relocations, and imports\n  * Add nds32 reloc support and optimize kernelcache parsing\n  * Build: install to lib64, fix illumos and packaging issues\n  * CI: add GitHub Actions and FilC builds\n  * Console: fix multiple overflows, OOB issues, and improve performance\n  * Core: API renames, plugin load order, sandbox/config fixes\n  * Crash: extensive fixes (UAF, OOB, overflows, injections, fuzz bugs)\n  * Harden ELF, PDB, kernelcache, regex, disassemblers, and webserver\n  * Debug: improve ptrace, winkd support, breakpoints, checkpoints\n  * Disasm: cache flag lookups for performance\n  * FS/IO: fix leaks, bounds, sparse IO, and device handling\n  * HTTP/socket: webserver fixes and SSL fallback handling\n  * Print/projects: improve formatting, endian handling, project metadata\n  * Pseudo: add while/switch support and cleaner control flow\n  * Search/shell: improve commands, parsing, and usability\n  * Security: fix widespread command injection and sandbox escapes\n  * Tests/tools: improve r2r, CLI tools, fuzzing, and plugin support\n  * Types/util: parsing improvements, JSON/base64 updates, optimizations\n  * Visual: fix UAF/leaks, improve panels and UX\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.1.4\n\n- Update to version 6.1.2:\n  * Analysis: preserve timeouts, improve bb/jmptbl validation and limits\n  * Optimize string detection and hot-path functions\n  * Add APIs for function signatures, vars limits, and instruction hints\n  * Fix overlapped functions, invalid code checks, and large bb handling\n  * API: remove deprecated librmagic/filetype APIs and name filter\n  * Arch: fix Thumb/endianness issues, add Python pseudo plugin\n  * ASM: unify settings via RArch, fix directives, add bf pseudo plugin\n  * Bin: improve ELF/Mach-O stripped detection and parsing safety\n  * Harden Mach-O bounds, optimize kernelcache and XNU parsing\n  * Fix many leaks (DEX, demangler, parsers) and infinite loops\n  * Improve DWARF handling and symbol/type extraction\n  * Build: improve meson, toolchains, and add ISO/docker support\n  * Console: preserve timeout, fix themes and UTF-8 handling\n  * Core: fix config bugs, improve startup and addressing support\n  * Crash: fix UAF, OOB, race conditions, regex bugs, and overflows\n  * Add safety checks across dotnet, Mach-O, DWARF, and webserver\n  * Debug/ESIL: safer execution and divide-by-zero handling\n  * FS/IO: fix HFS+, dyldcache speedups, safer zip handling\n  * Graph: add bb size limit option\n  * Print: merge commands, improve UTF-8 and formatting\n  * Projects/tools: new configs, plugin support, CLI improvements\n  * Search: faster analysis search and block buffering\n  * Shell: improve grep/macros and file operations\n  * Types: lazy-load, cache, and improve parsing (varargs, structs)\n  * Tests: expand fuzzing and test suites\n  * General cleanup, performance tuning, and safety improvements\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.1.4\n\n- Update to version 6.1.0:\n  * Reimplement RBufRef using RRef; fix RLibDelHandler API\n  * Remove stale JAY code; improve analysis performance and CI speed\n  * Optimize type propagation, jump tables, and plugin integration\n  * Fix infinite loops, antidisasm tricks, and function autonaming\n  * Add new analysis options and trace import plugin (DRCOV)\n  * Improve RCore seek operations and naming APIs\n  * API: add RNum.getErr, enforce safe alloc macros, new helpers\n  * Arch: update ARC disasm, refactor sessions, remove unsafe string ops\n  * ASM: improve x86 validation, add CIL and ARC pseudo plugins\n  * Bin: major fixes for PE, ELF, Java, MDMP, LE, DEX; reduce memory use\n  * Add/import DWARF types, improve relocations and symbol handling\n  * Extensive memory leak fixes and parser hardening across formats\n  * Improve string handling, caching, and zero-copy optimizations\n  * Build: improve meson, remove zip deps, add 3rd-party plugin support\n  * Console: fix UTF-8 graphs and color propagation\n  * Core: improve plugin handling and background task stability\n  * Crash: fix multiple UAF, OOB, overflows, and injection issues\n  * Sanitize inputs (function names, demangler, callconv)\n  * Debug: add source breakpoints, ARM64/XNU support, FPU regs\n  * Disasm: improve string handling, comments, and color logic\n  * ESIL: extend x86 FPU emulation\n  * FS/IO: fixes and plugin reorganizations\n  * HTTP: fix sandbox webserver issues\n  * Hash/tools: minor fixes and output improvements\n  * General cleanup, safety checks, and performance optimizations\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.1.0\n\n- Update to version 6.0.8:\n  * Migrate r_vector to RVec across core components\n  * Refactor and optimize type propagation (now plugin-based)\n  * Remove redundant anal.a2f and related duplication\n  * Improve caching, memoization, and performance in analysis\n  * Fix file corruption, null asserts, and command issues\n  * Enhance x86 (AT\u0026T syntax, enter instruction) and z80 support\n  * Add initial .NET (CIL) disasm/asm support\n  * Improve Java, ELF, Mach-O, APK, and PDB handling\n  * Fix demangling, symbols, and relocation issues\n  * Resolve multiple memory leaks and parser bugs\n  * Fix UAF, OOB, overflows, and command injection vulnerabilities\n  * Improve GDB debugging and breakpoint handling\n  * Enhance disassembly visuals and color options\n  * Update ESIL operators and behavior\n  * Add support for APFS, GPT, BSD, APM partitions\n  * Improve IO handling and add new plugins\n  * Optimize performance (strbuf, memory usage)\n  * Improve console UI, themes, and terminal handling\n  * Refine SDK builds and CI pipelines\n  * Improve CLI tools (rabin2, rasm2, rafs2)\n  * Add JSON support and better help/version info\n  * Expand type parsing (typedef, enum, union)\n  * Improve socket/HTTP handling and downloads\n  * Add and refine tests and reporting\n  * General cleanup, safety checks, and code modernization\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.0.8\n\n- Update to version 6.0.7:\n  * shell: Fix parsing r2 -H$(VARNAME) without a space\n\n- Update to version 6.0.6:\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.0.6\n\n- Update to version 6.0.4:\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.0.4\n\n- Update to version 6.0.2:\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.0.2\n\n- Update to version 6.0.0:\n  * ABI changes:\n    ~ RCorePlugins now have a session\n    ~ Finish the RKons refactoring, all r_cons calls take instance instead of global\n    ~ Rename RCrypto to RMuta\n    ~ Use RCons instance from RLine\n    ~ Rename RIOPlugin.widget to RIOPlugin.data\n    ~ Refactor the RRegAlias api\n    ~ Camelcase all the RCoreBind methods\n  * Breaking API changes:\n    ~ Boolify r_cons_rgb_parse\n    ~ Add RLogLevel.fromString() and use it from -e log.level=?\n    ~ Deprecate r_bin_addr2line\n    ~ Rename RBinDbgItem into RBinAddrline\n    ~ RNumCalc is now known as RNumMath\n    ~ Move RFlagItem.alias into the Meta\n    ~ Rename core-\u003eoffset into core-\u003eaddr (asm.offset and more!)\n    ~ Rename RFlagItem.offset -\u003e addr\n  * API changes:\n    ~ Boolify r_cons_rgb_parse\n    ~ Add RLogLevel.fromString() and use it from -e log.level=?\n    ~ Deprecate r_bin_addr2line\n    ~ Rename RBinDbgItem into RBinAddrline\n    ~ RNumCalc is now known as RNumMath\n    ~ Move RFlagItem.alias into the Meta\n    ~ Rename core-\u003eoffset into core-\u003eaddr (asm.offset and more!)\n    ~ Rename RFlagItem.offset -\u003e addr\n    ~ Deprecate RLang.list()\n    ~ Unified function to jsonify the plugin meta + more fields\n    ~ Redesign the REvent API\n  * Full changelog is available at:\n    https://github.com/radareorg/radare2/releases/tag/6.0.0\n\n- CVE-2025-5641: Fix memory corruption by manipulation of the argument -T (bsc#1244121)\n- CVE-2025-1864: Fix buffer overflow and potential code execution (bsc#bsc#1238451)\n- CVE-2025-1744: Fix heap-based buffer over-read or buffer overflow (bsc#1238075)\n- CVE-2025-1378: Fix memory corruption (bsc#1237250)\n\n- Update to version 5.9.8:\n  * Resolved CVE:\n    - CVE-2024-29645: buffer overflow vulnerability allows an attacker to\n      execute arbitrary code via the parse_die function (boo#1234065).\n  For details, check full release notes:\n  https://github.com/radareorg/radare2/releases/tag/5.9.8\n  https://github.com/radareorg/radare2/releases/tag/5.9.6\n  https://github.com/radareorg/radare2/releases/tag/5.9.4\n  https://github.com/radareorg/radare2/releases/tag/5.9.2\n  https://github.com/radareorg/radare2/releases/tag/5.9.0\n","status":"published","published":"2026-04-29T08:45:46Z","modified":"2026-05-01T18:27:00.404849Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}