CVE catalog

CVE-2026-8696

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbit

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 25, 2026

A flaw was found in radare2. This use-after-free vulnerability in the GDB client core, specifically within the `gdbr_pids_list()` function, could allow a remote attacker to achieve arbitrary code execution or cause a denial of service. The vulnerability is triggered by sending malformed thread information responses, leading to double-free memory corruption. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cperadare2Not reportedNot reportedunknown
Opensuseradare2tumbleweed6.2.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Opensuseradare2rpmtumbleweed6.2.0-1.1Not reportedOPENSUSE-SU-2026:11479-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libsdb2_5_0]Unknown

    Source package: [radare2]

    Details (1)

    • 6.2.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.2.0-1.1

      Version impact unknown

      nvd · radare2 · opensuse · tumbleweed

  • [radare2-devel]Unknown

    Source package: [radare2]

    Details (1)

    • 6.2.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.2.0-1.1

      Version impact unknown

      nvd · radare2 · opensuse · tumbleweed

  • [radare2-zsh-completion]Unknown

    Source package: [radare2]

    Details (1)

    • 6.2.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 6.2.0-1.1

      Version impact unknown

      nvd · radare2 · opensuse · tumbleweed

  • [radare2]Fixed

    Source package: [radare2]

    Details (1)

    • 6.2.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 6.2.0-1.1

      nvd · radare2 · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]