Threat database

rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the demangler structure is not yet initialized. This issue is fixed in commit 6bf56d3.

CVE-2026-45324 is a low-severity vulnerability in the rizin reverse engineering framework caused by a double free error in the byte_pattern_search function due to incorrect pointer ownership. This flaw can lead to a denial of service by crashing the application. The issue is fixed in commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe. No known exploits are reported in the wild. The vulnerability affects versions of rizin prior to this commit.

Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a heap-buffer-overflow in librz/bin/format/omf/omf.c. This vulnerability is fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.

CVE-2026-22780 is a medium severity heap overflow vulnerability in rizin versions prior to 0.8.2. It occurs when rizin parses a malicious Mach-O file containing bogus entries in the dyld chained segments, leading to allocation of resources without proper limits or throttling. Exploitation requires local access and user interaction, with no privileges needed, and can result in partial integrity and availability impacts. The vulnerability has not been observed exploited in the wild and was fixed in version 0.8.2. European organizations using rizin for reverse engineering or malware analysis should update promptly to mitigate risks. The threat primarily affects UNIX-like environments where rizin is deployed, with higher relevance in countries with strong cybersecurity research and software development sectors.