CVE-2025-5647 is a memory corruption vulnerability identified in Radare2 version 5.9.9, specifically within the radiff2 component's function r_cons_context_break_pop located in the /libr/cons/cons.c source file. The vulnerability arises from improper handling of the '-T' argument, which is documented as experimental and prone to causing crashes. When this argument is manipulated, it can lead to memory corruption. Exploitation requires local access to the system, and the attack complexity is considered high due to the difficulty in reliably triggering the vulnerability. The vulnerability does not require user interaction but does require low-level privileges (local privileges) to execute. The vulnerability has been publicly disclosed, and a patch has been made available under the commit identifier 5705d99cc1f23f36f9a84aab26d1724010b97798. However, the real existence of the vulnerability has been questioned, and further analysis suggests that race conditions are not a significant concern unless AddressSanitizer (ASan) is used. A new warning has been added to the software to highlight the instability of the '-T' parameter. The CVSS v4.0 base score is 2.0, indicating a low severity level, primarily due to the requirement for local access, high attack complexity, and limited impact on confidentiality, integrity, and availability. No known exploits are currently active in the wild.

For European organizations, the impact of this vulnerability is limited due to several factors. Radare2 is an open-source reverse engineering framework primarily used by security researchers, malware analysts, and developers rather than mainstream enterprise applications. The requirement for local access and low privileges reduces the risk of remote exploitation or widespread compromise. However, organizations that rely on Radare2 for internal security analysis or software debugging could face stability issues or potential memory corruption leading to denial of service or application crashes. In environments where Radare2 is used on sensitive systems, an attacker with local access could potentially leverage this vulnerability to disrupt analysis workflows or cause application instability. The low severity and high complexity of exploitation mean that the vulnerability is unlikely to be a significant vector for large-scale attacks within European enterprises. Nonetheless, organizations should remain vigilant, especially those involved in cybersecurity research or software development that utilize Radare2.

European organizations using Radare2 version 5.9.9 should apply the official patch identified by commit 5705d99cc1f23f36f9a84aab26d1724010b97798 to remediate the vulnerability. Given the experimental nature of the '-T' parameter, it is advisable to avoid using this argument in production or critical environments until the software is confirmed stable. Organizations should enforce strict access controls to limit local access to systems running Radare2, ensuring only authorized personnel can execute the tool. Monitoring and logging local user activities involving Radare2 can help detect any anomalous usage patterns. Additionally, integrating AddressSanitizer or similar memory debugging tools during development and testing phases can help identify potential memory corruption issues early. Regularly updating Radare2 to the latest stable versions and subscribing to security advisories related to the tool will further reduce exposure to similar vulnerabilities.