CVE-2025-5646 Radare2 radiff2 pal.c r_cons_rainbow_free memory corruption
Local attackers can trigger memory corruption in Radare2's radiff2 component via the experimental -T argument, causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5646?
CVE-2025-5646 is a low-severity memory corruption vulnerability in Radare Radare2, published on 5 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects the function r_cons_rainbow_free in the library /libr/cons/pal.c of the component radiff2. The manipulation of the argument -T leads to memory corruption. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added.
Weakness: CWE-119
Which versions are affected by CVE-2025-5646?
It affects 1 product.
Products include Radare Radare2.
How do I fix CVE-2025-5646?
No fix has been published for CVE-2025-5646 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-5646 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5646 exists.
Other vulnerabilities in Radare Radare2
Sources
Also known as GHSA-xj7j-3mcr-9ppq, UBUNTU-CVE-2025-5646.