CVE-2025-60359

EUVD-2025-34882
radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.93%
Affected Products (NVD)
VendorProductVersion
radareradare2
𝑥
≤ 5.9.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
radare2
sid
6.1.8+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
radare2
bionic
Fixed 2.3.0+dfsg-2ubuntu0.1~esm1
released
focal
Fixed 4.2.1+dfsg-2ubuntu0.1~esm1
released
jammy
dne
noble
Fixed 5.5.0+dfsg-1.1ubuntu3+esm1
released
plucky
Fixed 5.9.8+dfsg-2ubuntu0.25.04.2
released
questing
Fixed 5.9.8+dfsg-2ubuntu0.25.10.2
released
resolute
not-affected
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/radareorg/radare2/pull/24215