CVE-2025-1378

low-risk
Published 2025-02-17

A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Radare

References (7)

Patch https://github.com/radareorg/radare2/commit/c6c772d2eab692ce7ada5a4227afd50c355a...
Exploit https://github.com/radareorg/radare2/issues/23953
Exploit https://github.com/radareorg/radare2/issues/23953#issue-2844325926
Release Notes https://github.com/radareorg/radare2/milestone/86
Permissions Required https://vuldb.com/?ctiid.295986
Third Party Advisory https://vuldb.com/?id.295986
Third Party Advisory https://vuldb.com/?submit.498499
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal