CVE-2026-45324: CWE-415: Double Free in rizinorg rizin
CVE-2026-45324 is a low-severity vulnerability in the rizin reverse engineering framework caused by a double free error in the byte_pattern_search function due to incorrect pointer ownership. This flaw can lead to a denial of service by crashing the application. The issue is fixed in commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. No known exploits are reported in the wild. The vulnerability affects versions of rizin prior to this commit.
AI Analysis
Technical Summary
Rizin, a UNIX-like reverse engineering toolset, contains a double free vulnerability in the function byte_pattern_search located in librz/core/cmd/cmd_search.c. The root cause is incorrect pointer ownership declaration, which results in the same memory being freed twice. This can cause application instability or crashes. The vulnerability is tracked as CVE-2026-45324 with a CVSS 3.3 (low) score, reflecting low impact on confidentiality and integrity but some impact on availability. The issue is resolved by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.
Potential Impact
The vulnerability can cause a denial of service by crashing the rizin application due to double freeing memory. There is no impact on confidentiality and only limited impact on integrity. No known exploitation in the wild has been reported.
Mitigation Recommendations
A fix is available in rizin as of commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. Users should update to versions including this commit or later to remediate the vulnerability. Patch status is confirmed by the vendor commit reference. No additional mitigation steps are indicated.
CVE-2026-45324: CWE-415: Double Free in rizinorg rizin
Description
CVE-2026-45324 is a low-severity vulnerability in the rizin reverse engineering framework caused by a double free error in the byte_pattern_search function due to incorrect pointer ownership. This flaw can lead to a denial of service by crashing the application. The issue is fixed in commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. No known exploits are reported in the wild. The vulnerability affects versions of rizin prior to this commit.
CVSS v3.1
Score 3.3low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rizin, a UNIX-like reverse engineering toolset, contains a double free vulnerability in the function byte_pattern_search located in librz/core/cmd/cmd_search.c. The root cause is incorrect pointer ownership declaration, which results in the same memory being freed twice. This can cause application instability or crashes. The vulnerability is tracked as CVE-2026-45324 with a CVSS 3.3 (low) score, reflecting low impact on confidentiality and integrity but some impact on availability. The issue is resolved by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.
Potential Impact
The vulnerability can cause a denial of service by crashing the rizin application due to double freeing memory. There is no impact on confidentiality and only limited impact on integrity. No known exploitation in the wild has been reported.
Mitigation Recommendations
A fix is available in rizin as of commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. Users should update to versions including this commit or later to remediate the vulnerability. Patch status is confirmed by the vendor commit reference. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-11T20:50:30.539Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a19e68ee29bf47b50037d63
Added to database: 05/29/2026, 19:18:38 UTC
Last enriched: 06/05/2026, 21:20:34 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.