Integer overflow in radare2 - #VU142706

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the CPython bytecode (.pyc) marshal parser when parsing a specially crafted .pyc file. A remote attacker can provide a .pyc file with an attacker-controlled length value to cause a denial of service.

User interaction is required to open or inspect the crafted file, including with r2 or rabin2.

Affected software

Remediation

External References

• https://github.com/radareorg/radare2/security/advisories/GHSA-9phv-v2w8-56j3
• https://github.com/radareorg/radare2/commit/6727454b666b28c33837b219a5f91136461357c0

Related Security Bulletins

• Multiple vulnerabilities in radare2