CVE-2026-31053 Use after free in n/a

What is CVE-2026-31053?

CVE-2026-31053 is a medium-severity use after free vulnerability in n/a, published on 6 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially crafted LE binary can trigger heap corruption and cause the application to crash, resulting in a denial-of-service condition. An attacker with a crafted binary could cause a denial of service when the tool is integrated on a service pipeline.

Weakness: CWE-415

Which versions are affected by CVE-2026-31053?

It affects 1 product.

Products include Rizin Rizin.

How do I fix CVE-2026-31053?

No fix has been published for CVE-2026-31053 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-31053 being exploited?

There is no known exploitation of CVE-2026-31053 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-31668 rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta. Critical 9.1
• CVE-2023-40022 Rizin vulnerable to Integer Overflow in C++ demangler logic High 7.8
• CVE-2021-3674 Memory corruption in rizin High 7.8
• CVE-2023-27590 Rizin has stack-based buffer overflow when parsing GDB registers profile files High 7.8
• CVE-2022-36039 Out-of-bounds write when parsing DEX files in Rizin High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h848-fw25-hp2w.