CVE-2026-8696 Details
Description
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.
A use-after-free vulnerability has been identified in Radare2 version 6.1.5, specifically within the GDB client core's gdbr_pids_list() function. This vulnerability allows remote attackers to cause a denial-of-service or potentially execute arbitrary code by sending malformed thread information responses. The issue arises when the qsThreadInfo command fails after the qfThreadInfo command successfully allocates RDebugPid structures. This sequence leads to double-free memory corruption, as the error handling path attempts to clean up the list, resulting in a use-after-free condition.
Users can upgrade to Radare2 version 6.1.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/radareorg/radare2/issues/25836 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/radareorg/radare2/commit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c | [email protected] | Patch |
| https://github.com/radareorg/radare2/issues/25836 | [email protected] | ExploitIssue Tracking |
| https://www.vulncheck.com/advisories/radare2-use-after-free-via-gdbr-pids-list | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| radare radare2 | <= 6.1.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | New CVE Received | [email protected] |