CVE-2025-5643 is a memory corruption vulnerability identified in Radare2 version 5.9.9, specifically within the function cons_stack_load located in the /libr/cons/cons.c source file of the radiff2 component. The vulnerability arises from improper handling of the -T argument, which is documented as experimental and prone to crashes. When this argument is manipulated, it can lead to memory corruption. Exploitation requires local access to the system and is considered complex and difficult, with no user interaction needed but requiring low privileges. The vulnerability does not affect confidentiality, integrity, or availability in a significant manner, as indicated by its low CVSS score of 2.0 (CVSS 4.0 vector: AV:L/AC:H/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N). The exploit has been publicly disclosed, but its practical existence is questioned, and no known exploits are currently observed in the wild. A patch identified by commit 5705d99cc1f23f36f9a84aab26d1724010b97798 has been released to address this issue. Additional analysis notes that race conditions related to this vulnerability are not a concern unless AddressSanitizer (ASAN) is used. A warning has been added to the software to highlight the experimental and unstable nature of the -T parameter.

For European organizations, the impact of this vulnerability is limited due to several factors. Radare2 is a reverse engineering framework primarily used by security researchers, malware analysts, and developers rather than general enterprise applications. The requirement for local access and the high complexity of exploitation reduce the risk of widespread attacks. The vulnerability does not compromise critical security properties such as confidentiality or integrity in a meaningful way, nor does it lead to denial of service or system-wide compromise. However, organizations relying on Radare2 for security analysis or development should be aware that exploitation could lead to application crashes or unstable behavior, potentially disrupting workflows. Since the vulnerability is tied to an experimental feature (-T argument), typical usage scenarios may not trigger the issue. Nonetheless, the presence of a public exploit disclosure means that targeted attackers with local access could attempt exploitation, emphasizing the need for patching in sensitive environments.

To mitigate this vulnerability, European organizations using Radare2 5.9.9 should apply the official patch identified by commit 5705d99cc1f23f36f9a84aab26d1724010b97798 as soon as possible. Avoid using the experimental -T argument in radiff2 unless absolutely necessary, as it is known to be unstable and the root cause of this issue. Implement strict access controls to limit local access to systems running Radare2, reducing the attack surface. Employ monitoring to detect unusual local activity involving Radare2 usage. For environments using AddressSanitizer (ASAN), extra caution is advised since race conditions may be more problematic. Regularly update Radare2 to the latest stable versions to benefit from ongoing security improvements. Additionally, educate users about the risks of using experimental features and encourage adherence to best practices when handling security tools.