CVE-2026-45324 is a double free vulnerability (CWE-415) in the rizin reverse engineering tool, specifically in the byte_pattern_search function within librz/core/cmd/cmd_search.c. The issue arises from incorrect pointer ownership declarations, causing memory to be freed twice. This can result in application instability or crashes. The vulnerability affects versions of rizin prior to the commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe, which contains the fix. The CVSS 3.1 base score is 3.3, indicating low severity, with attack vector as physical, high attack complexity, low privileges required, and user interaction needed.

The impact is limited to potential denial of service or minor integrity issues due to double free memory corruption. There is no confidentiality impact. The low CVSS score reflects the requirement for physical access, high attack complexity, and user interaction, limiting exploitability. No known exploits are reported in the wild.

A fix is available in the rizin source code at commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. Users should update to this or later versions to remediate the vulnerability. Patch status is not explicitly confirmed via a vendor advisory, so users should verify the update from the official rizin repository or project communications.