Radare2 5.9.9 radiff2 /libr/cons/cons.c r_cons_context_break_pop -T memory corruption ⚔ [Disputed]

Summaryinfo

A vulnerability classified as problematic has been found in Radare2 5.9.9. Affected by this vulnerability is the function r_cons_context_break_pop in the library /libr/cons/cons.c of the component radiff2. The manipulation of the argument -T leads to memory corruption. This vulnerability is referenced as CVE-2025-5647. The attack can only be performed from a local environment. Furthermore, an exploit is available. The real existence of this vulnerability is still doubted at the moment. It is recommended to apply a patch to fix this issue. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added.

Detailsinfo

A vulnerability was found in Radare2 5.9.9 and classified as problematic. This issue affects the function r_cons_context_break_pop in the library /libr/cons/cons.c of the component radiff2. The manipulation of the argument -T with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-5647. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details as well as a public exploit are known.

The exploit is available at drive.google.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added. The vulnerability scanner Nessus provides a plugin with the ID 275939 (TencentOS Server 4: radare2 (TSSA-2025:0547)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 5705d99cc1f23f36f9a84aab26d1724010b97798 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (275939) and EUVD (EUVD-2025-16978). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Tool Software

Name

• Radare2

Version

• 5.9.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #586928: radare2 radiff2 5.9.9 and master branch Memory corruption (by rootsec)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion