CVE-2017-6387 in radare2
Summary
by MITRE
The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2025
The vulnerability identified as CVE-2017-6387 resides within the radare2 reverse engineering framework, specifically in the dex_loadcode function located in libr/bin/p/bin_dex.c at version 1.2.1. This flaw represents a critical security issue that affects the binary analysis capabilities of the tool when processing Android DEX (Dalvik Executable) files. The vulnerability stems from inadequate input validation and boundary checking within the function responsible for loading and parsing DEX code structures, creating a pathway for malicious actors to exploit the software through crafted DEX payloads.
The technical implementation of this vulnerability manifests as an out-of-bounds read condition that occurs when the dex_loadcode function processes malformed DEX files containing specially crafted data structures. This flaw allows attackers to manipulate the parsing logic by providing a malicious DEX file that contains invalid or unexpected data in critical offset fields. When the function attempts to access memory locations beyond the allocated bounds of the DEX file structure, it triggers an application crash or segmentation fault, effectively causing a denial of service condition that renders the radare2 tool unusable for its intended binary analysis purposes.
The operational impact of this vulnerability extends beyond simple service disruption as it undermines the reliability and trustworthiness of the radare2 framework in security research and malware analysis contexts. Security professionals and researchers who rely on radare2 for analyzing Android applications and reverse engineering activities could find their work interrupted by this vulnerability, potentially compromising ongoing investigations or analysis processes. The remote nature of the attack means that an adversary could exploit this weakness without physical access to the target system, making it particularly dangerous in environments where automated analysis systems process untrusted DEX files from external sources.
This vulnerability aligns with CWE-125, which describes out-of-bounds read conditions, and demonstrates how insufficient input validation can lead to memory corruption issues that ultimately result in application instability. From an ATT&CK perspective, this represents a denial of service technique that can be leveraged as part of broader attack chains where adversaries seek to disrupt security tooling and analysis capabilities. The vulnerability also connects to broader patterns of memory safety issues commonly found in C/C++ applications that lack proper bounds checking and input sanitization mechanisms.
Mitigation strategies for CVE-2017-6387 should prioritize immediate patching of affected radare2 installations to version 1.2.2 or later, where the vulnerability has been addressed through proper input validation and boundary checking implementations. Organizations should also implement defensive measures such as validating DEX file integrity before processing, employing sandboxed environments for DEX analysis, and maintaining updated threat intelligence regarding malicious DEX samples. Additionally, security teams should consider implementing network-based detection rules that monitor for anomalous DEX file processing patterns that could indicate exploitation attempts, while also ensuring that automated analysis systems include proper error handling and graceful degradation capabilities to prevent complete system failures during exploitation attempts.