Vulnerability · Published May 13, 2022 · Assigned by @huntrdev
CVE-2022-1714Out-of-bounds Read in radareorg/radare2
High 7.9
In plain English
A high-severity out-of-bounds read in radareorg/radare2 from radareorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)7.9High
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1714 |
| Alpine:v3.21 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1714 |
| Alpine:v3.22 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1714 |
| Alpine:v3.23 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1714 |
| Alpine:v3.24 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1714 |
| Ubuntu:25.10 | radare2 | no fix listed | UBUNTU-CVE-2022-1714 |
| Ubuntu:26.04:LTS | radare2 | no fix listed | UBUNTU-CVE-2022-1714 |
| Ubuntu:26.10 | radare2 | no fix listed | UBUNTU-CVE-2022-1714 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| radareorg | radareorg/radare2 | unspecified – before 5.7.0 |
Weakness: CWE-125 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L