PT-2026-5711 · Rizin · Rizin

Xobx-Cherif · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-22780

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Rizin versions prior to 0.8.2

Description Rizin, a reverse engineering framework, contains a flaw where a heap overflow can occur when processing maliciously crafted mach0 files with invalid dyld chained segment entries. This issue can be triggered by parsing such files with rizin.

Recommendations Update to version 0.8.2 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-22780

GHSA-F3V7-XHMJ-9CJJ

OPENSUSE-SU-2026:10141-1

Affected Products

Rizin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22780.json · Exploit
• https://github.com/rizinorg/rizin/security/advisories/GHSA-f3v7-xhmj-9cjj · Vendor Advisory
• https://github.com/rizinorg/rizin/commit/41ea75d5b07d9b41b27ae80675cdda65f1b1c989 · Patch
• https://github.com/rizinorg/rizin/blob/6dd0dba9ff4dc706f549d0cdcd93856b49e59aa0/librz/bin/format/mach0/mach0_chained_fixups.c#L200 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10141-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22780 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22780 · Vendor Advisory
• https://github.com/rizinorg/rizin/pull/5770 · Note
• https://github.com/rizinorg/rizin/issues/5768 · Note
• https://github.com/rizinorg/rizin/releases/tag/v0.8.2 · Note
• https://twitter.com/VulmonFeeds/status/2018522687048495115 · Twitter Post
• https://twitter.com/CVEnew/status/2018465525559423039 · Twitter Post
• https://suse.com/security/cve/CVE-2026-22780 · Note