CVE-2025-5646 in Radare2
Summary
by MITRE • 06/05/2025
A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects the function r_cons_rainbow_free in the library /libr/cons/pal.c of the component radiff2. The manipulation of the argument -T leads to memory corruption. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/21/2025
CVE-2025-5646 represents a memory corruption vulnerability within Radare2 version 5.9.9 that specifically targets the r_cons_rainbow_free function located in the /libr/cons/pal.c library component of the radiff2 utility. This vulnerability manifests when the -T command line argument is manipulated, creating a condition where improper memory handling can lead to arbitrary code execution or system instability. The flaw exists within the rainbow color palette functionality that Radare2 employs for console output visualization, making it particularly concerning for security researchers and analysts who rely on this tool for binary analysis and reverse engineering tasks.
The technical implementation of this vulnerability stems from inadequate input validation and memory management within the r_cons_rainbow_free function, which processes color palette data structures. When the -T parameter is utilized, the function fails to properly validate or sanitize the input data, leading to potential buffer overflows or use-after-free conditions in memory allocation routines. This type of vulnerability aligns with CWE-121, which describes stack-based buffer overflow conditions, and CWE-416, which covers use-after-free errors. The attack vector requires local execution and involves crafting specific input parameters that trigger the flawed memory handling code path, making it accessible to attackers with local system access or those who can influence the execution environment.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling privilege escalation or denial of service conditions within systems that utilize Radare2 for security analysis or software development activities. Given that this vulnerability affects a core component of the radiff2 utility, which is commonly used for binary diffing and comparison operations, attackers could potentially compromise the integrity of security analysis workflows. The difficulty of exploitation, while noted as high complexity, is concerning because the vulnerability has been publicly disclosed and may already be in active use by threat actors. The fact that the parameter -T is documented as experimental and "crashy" suggests that the developers were already aware of stability issues, yet the vulnerability remained unpatched in the released version.
Security practitioners should prioritize applying the patch identified by commit hash 5705d99cc1f23f36f9a84aab26d1724010b97798, which addresses the memory handling issues in the rainbow palette functionality. The mitigation strategy should include immediate patch deployment across all systems where Radare2 is installed and actively used, particularly in security research environments where the tool is extensively utilized. Organizations should also implement monitoring for unusual process behavior or memory allocation patterns when using radiff2 with the -T parameter, as this may indicate exploitation attempts. The vulnerability's classification as local-only does not diminish its importance, as local privilege escalation opportunities often exist within security tooling environments, and the presence of a public exploit increases the risk to systems where Radare2 is used with elevated privileges.
The broader implications of this vulnerability highlight the importance of proper input validation and memory management in security tools, as these applications often process untrusted data from various sources. The ATT&CK framework's T1059.007 technique for command and scripting interpreter execution becomes relevant when considering how this vulnerability could be leveraged in automated security testing environments, where the tooling might be used in compromised workflows. The warning about the race condition not being a real problem unless using address sanitizer (ASAN) indicates that the vulnerability's manifestation may be environment-dependent, but this does not eliminate the need for immediate remediation, as production environments typically do not employ ASAN for performance reasons. Security teams should also consider implementing network segmentation and access controls to limit local system access where Radare2 is deployed, reducing the attack surface for potential exploitation.