PT-2026-41375 · Radare2 · Radare2

Saad Elharaj · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-8696

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr pids list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-8696

Affected Products

Radare2

References · 4

• https://github.com/radareorg/radare2/commit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8696 · Security Note
• https://github.com/radareorg/radare2/issues/25836 · Note
• https://vulncheck.com/advisories/radare2-use-after-free-via-gdbr-pids-list · Note