CVE-2022-36043 in Rizin
Summary
by MITRE • 09/07/2022
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/16/2026
The vulnerability CVE-2022-36043 affects Rizin, a popular UNIX-like reverse engineering framework that serves as both a command-line toolset and a comprehensive binary analysis platform. This security flaw exists within the bobj.c file at the rz_bin_reloc_storage_free() function, specifically manifesting as a double free condition that occurs during the processing of relocation entries generated by the qnx binary plugin. The vulnerability represents a critical memory corruption issue that can be exploited through the manipulation of malicious qnx binary files, potentially allowing remote code execution on systems where Rizin is used for binary analysis. The affected versions include all releases up to and including 0.4.0, making this a significant concern for users who may encounter untrusted binary files during their reverse engineering activities.
The technical implementation of this vulnerability stems from improper memory management within the relocation storage cleanup routine. When Rizin processes qnx binary files through its specialized plugin, it generates relocation entries that are subsequently stored in memory structures. The double free condition occurs when the rz_bin_reloc_storage_free() function attempts to free the same memory block twice during the cleanup process. This memory management error typically arises from flawed reference counting or improper handling of object lifecycles within the binary analysis framework. The vulnerability is particularly dangerous because qnx binaries are often encountered in embedded systems analysis, firmware reverse engineering, and security research contexts where analysts may encounter untrusted or malicious binary content. The commit a3d50c1ea185f3f642f2d8180715f82d98840784 specifically addresses this issue by correcting the memory deallocation logic and ensuring proper object lifecycle management.
The operational impact of CVE-2022-36043 extends beyond simple memory corruption, as it creates a potential remote code execution vector that could be exploited by attackers. An attacker who can convince a user to open a specially crafted malicious qnx binary file through Rizin would be able to trigger the double free condition and potentially execute arbitrary code on the victim's machine with the privileges of the user running Rizin. This threat model aligns with common attack patterns found in software exploitation techniques and is particularly concerning given Rizin's widespread use in security research, penetration testing, and reverse engineering workflows. The vulnerability could be leveraged in supply chain attacks where malicious binaries are introduced into analysis environments, or in targeted attacks against security researchers who regularly process binary files from untrusted sources. The impact is amplified by the fact that Rizin is often used in automated analysis pipelines and security tools that may process large volumes of binary content without proper user intervention.
Mitigation strategies for this vulnerability should focus on immediate version updates to Rizin 0.4.1 or later, which contains the patched implementation addressing the double free condition. Users should also implement defensive measures such as running Rizin in restricted environments or sandboxed execution contexts to limit potential damage from exploitation attempts. Security teams should conduct vulnerability assessments to identify systems running affected versions of Rizin and ensure proper patch management procedures are in place. The vulnerability demonstrates the importance of proper memory management practices in security-critical software and aligns with CWE-415, which covers double free conditions in software development. Organizations using Rizin as part of their security infrastructure should also consider implementing additional binary analysis safeguards, including static analysis tools and automated binary validation processes, to detect potentially malicious content before it reaches the Rizin analysis framework. The ATT&CK framework categorizes this vulnerability under T1059.007 for the execution of malicious code through analysis tools, highlighting the need for proper input validation and sandboxing practices in reverse engineering environments.