PT-2026-30615 · Git+1 · Rizin

Wargio · CVE-2026-31053 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Radare2 (affected versions not specified)

Description A double free issue occurs in the le load fixup record() function within the librz/bin/format/le/le.c file. This happens when the software processes malformed or circular LE fixup chains, causing relocation entries to be freed multiple times during error handling. A specially crafted LE binary can trigger heap corruption, leading to an application crash and a denial-of-service condition, particularly when the tool is integrated into a service pipeline.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-31053

Affected Products

Rizin

References · 5

• 🔥 https://github.com/rizinorg/rizin/issues/5753 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31053.json · Exploit
• https://github.com/rizinorg/rizin/pull/5795 · Patch
• https://osv.dev/vulnerability/CVE-2026-31053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31053 · Security Note