VDB
CVE-2025-1378
CVE-2025-1378
PUBLISHED
CVSS 4.800000190734863 MEDIUM
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
EPSS 0.32% · 24.2th percentile
Risk Scores
CVSS 4.0
4.800000190734863
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.32%
24.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| radare | radare2 | 5.9.9 |
| n/a | radare2 | 5.9.9 33286 |
Timeline
- Feb 16, 2025 CVE ID Reserved
- Feb 17, 2025 Coalition ESS Score
- Feb 17, 2025 CVE Published
- Feb 17, 2025 PoC Published
- Feb 17, 2025 PoC Published
- Feb 17, 2025 PoC Published
- Feb 18, 2025 EPSS Score
- Feb 18, 2025 CVE Updated
- Mar 5, 2025 EPSS Score
- Mar 20, 2025 EPSS Score
- Apr 4, 2025 EPSS Score
- Apr 19, 2025 EPSS Score
References
- https://github.com/radareorg/radare2/commit/c6c772d2eab692ce7ada5a4227afd50c355ad545 fix
- https://github.com/radareorg/radare2/issues/23953#issue-2844325926 discussion
- VDB-295986 | radare2 rasm2 rasm2.c memory corruption vdb
- VDB-295986 | CTI Indicators (IOB, IOC, IOA) url
- Submit #498499 | www.radare.org/ radare2/rasm2 473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81 negative size param third-party-advisory
- https://github.com/radareorg/radare2/milestone/86 patch
- https://github.com/radareorg/radare2/issues/23953 discussion
- https://nvd.nist.gov/vuln/detail/CVE-2025-1378 advisory