CVE-2026-8696 radare2 6.1.5 Use-After-Free via gdbr_pids_list()

What is CVE-2026-8696?

CVE-2026-8696 is a high-severity use after free vulnerability in Radare Radare2, published on 15 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.

Weakness: CWE-416

Which versions are affected by CVE-2026-8696?

It affects 1 product.

Products include Radare Radare2.

How do I fix CVE-2026-8696?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-8696 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8696 exists.

Other vulnerabilities in Radare Radare2

• CVE-2025-1864 Buffer Overflow and Potential Code Execution in Radare2 Critical 10.0
• CVE-2025-1744 Out-of-bounds Write in radare2 Critical 10.0
• CVE-2021-32494 Denial of service in radare2 Critical 10.0
• CVE-2021-32495 Use after free in radare2 Critical 10.0
• CVE-2024-29646 Memory corruption in n/a Critical 9.8

All Radare Radare2 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8j42-xqfj-g726, UBUNTU-CVE-2026-8696, openSUSE-SU-2026:11479-1.