CVE-2023-47016 in radare2
Summary
by MITRE • 11/22/2023
radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/20/2026
The vulnerability identified as CVE-2023-47016 affects radare2 version 5.8.9 and represents a critical out-of-bounds read condition that occurs within the binary analysis framework. This flaw manifests in the r_bin_object_set_items function located in libr/bin/bobj.c, where improper bounds checking allows an attacker to trigger memory access violations. The issue specifically impacts the r_read_le32 function found in libr/include/r_endian.h, which is responsible for reading little-endian 32-bit values from memory. When processing malformed binary files or attempting to analyze crafted input, the application fails to validate array indices or buffer boundaries, leading to unauthorized memory access patterns that ultimately result in application crashes and potential system instability.
The technical root cause of this vulnerability stems from inadequate input validation and memory management practices within radare2's binary parsing routines. The out-of-bounds read occurs when the software attempts to access memory locations beyond the allocated buffer boundaries during the processing of binary object metadata. This condition falls under the CWE-129 weakness category, which specifically addresses improper validation of array indices and buffer bounds checking. The vulnerability demonstrates a classic example of how insufficient bounds checking can lead to memory corruption issues that may be exploited to cause denial of service or potentially more severe consequences depending on the execution context. The flaw is particularly concerning because radare2 is widely used in security research, malware analysis, and reverse engineering contexts where analysts frequently process untrusted binary samples.
The operational impact of CVE-2023-47016 extends beyond simple application crashes to potentially compromise the integrity of security analysis workflows. Security professionals and researchers who rely on radare2 for binary analysis may find their tools becoming unstable when processing certain file formats or encountering maliciously crafted binaries. This vulnerability directly affects the reliability of the toolchain and could lead to interrupted analysis sessions, corrupted analysis results, or complete tool failure during critical security assessments. The crash condition may also provide attackers with opportunities to disrupt security operations by causing denial of service against analysis systems or potentially enabling more sophisticated exploitation techniques if combined with other vulnerabilities. From an attacker's perspective, this issue aligns with ATT&CK technique T1588.001, which covers the use of software supply chain compromises, as it represents a potential entry point for disrupting security tooling used by defenders.
Mitigation strategies for CVE-2023-47016 should prioritize immediate patching of affected radare2 installations to version 5.9.0 or later, which contains the necessary fixes for the out-of-bounds read condition. Organizations should implement defensive measures such as input validation and sandboxing when processing untrusted binary files, particularly in automated analysis environments. Security teams should also consider implementing monitoring solutions that can detect and alert on application crashes or memory access violations during binary analysis operations. The vulnerability highlights the importance of maintaining up-to-date security tooling and implementing proper code review processes that emphasize bounds checking and memory safety practices. Additionally, users should avoid processing untrusted binary samples without proper sandboxing mechanisms and consider implementing additional validation layers before performing deep binary analysis operations that could trigger similar memory corruption issues.