Radare2: Stack-use-after-return
Affects radare2Source GCVE Database
Rated by Threat Radar
Data as of 6 Nov 2026, 15:34 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
OSS-Fuzzradare2pkg:generic/radare2Other threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
A stack-use-after-return vulnerability has been identified in the check_buffer function of radare2, as reported by OSS-Fuzz. This issue involves reading memory after the stack frame has been returned, which can lead to undefined behavior. The vulnerability affects multiple specific versions of radare2 from 5.8.0 through 6.2.0 and a commit identified by hash 67ead854ea3736384f6d13a56ce9e5fa14c9478c. There is no CVSS score available, and no known exploits in the wild have been reported. The severity is assessed as medium based on the nature of the vulnerability and available information. No patch or remediation details are provided in the source data.