Rizin, a UNIX-like reverse engineering toolset, contains a heap-buffer-overflow vulnerability (CWE-125) in the OMF format handler located in librz/bin/format/omf/omf.c. This vulnerability allows an out-of-bounds read condition that could potentially leak information from heap memory. The issue is fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47. The CVSS 3.1 base score is 3.3, reflecting low severity with attack vector local, low attack complexity, no privileges required, but user interaction needed, and limited confidentiality impact.

The vulnerability could lead to limited information disclosure due to an out-of-bounds read on the heap. There is no impact on integrity or availability. Exploitation requires local access and user interaction, limiting the risk scope. No known exploits are reported in the wild.

A fix is available and implemented in commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47. Users should update rizin to a version that includes this commit to remediate the vulnerability. Patch status is confirmed by the vendor commit reference. No additional mitigation actions are indicated.