Radare2 5.9.9 radiff2 /libr/cons/pal.c r_cons_pal_init -T memory corruption ⚔ [Disputed]

Summaryinfo

A vulnerability classified as problematic was found in Radare2 5.9.9. Affected by this issue is the function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the argument -T results in memory corruption. This vulnerability is identified as CVE-2025-5648. The attack is only possible with local access. Additionally, an exploit exists. It is still unclear if this vulnerability genuinely exists. Applying a patch is advised to resolve this issue. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added.

Detailsinfo

A vulnerability was found in Radare2 5.9.9. It has been classified as problematic. Affected is the function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the argument -T with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-5648. The exploitability is told to be difficult. The attack needs to be approached locally. Technical details and a public exploit are known.

The exploit is shared for download at drive.google.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added. The vulnerability scanner Nessus provides a plugin with the ID 275939 (TencentOS Server 4: radare2 (TSSA-2025:0547)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 5705d99cc1f23f36f9a84aab26d1724010b97798 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (275939) and EUVD (EUVD-2025-16977). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Tool Software

Name

• Radare2

Version

• 5.9.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #586929: radare2 radiff2 5.9.9 and master branch Memory corruption (by rootsec)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion