radareorg has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 9. The median CVSS is 5.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-125 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Worst active — by depth score
CVE-2026-81879Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset42CVE-2026-81878Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset42CVE-2026-81886Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset30CVE-2026-81885Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset30CVE-2026-81883Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset30
radareorg vulnerabilities
CVEs affecting radareorg, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-81881Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata sect…
CVE-2026-81878Medium· 5.5PoCradare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without reje…
CVE-2026-81886Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run …
CVE-2026-81880Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded b…
CVE-2026-81885Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration l…
CVE-2026-81883Low· 3.3PoCradare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields imm…
CVE-2026-81882Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized U…
CVE-2026-81879Medium· 5.5PoCradare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but s…
CVE-2026-81884Low· 2.5PoCradare2 is a UNIX-like reverse engineering framework and command-line toolset
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a fi…