Vulnerability · Published Apr 22, 2022 · Assigned by @huntrdev
CVE-2022-1437Heap-based Buffer Overflow in radareorg/radare2
Medium 5.3
In plain English
A medium-severity heap buffer overflow in radareorg/radare2 from radareorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)5.3Medium
Exploit odds (30 days)0.8%top 44.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1437 |
| Alpine:v3.21 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1437 |
| Alpine:v3.22 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1437 |
| Alpine:v3.23 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1437 |
| Alpine:v3.24 | radare2 | 5.7.0-r0 | ALPINE-CVE-2022-1437 |
| Ubuntu:25.10 | radare2 | no fix listed | UBUNTU-CVE-2022-1437 |
| Ubuntu:26.04:LTS | radare2 | no fix listed | UBUNTU-CVE-2022-1437 |
| Ubuntu:26.10 | radare2 | no fix listed | UBUNTU-CVE-2022-1437 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| radareorg | radareorg/radare2 | unspecified – before 5.7.0 |
Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://huntr.dev/bounties/af6c3e9e-b7df-4d80-b48f-77fdd17b4038 x_refsource_CONFIRM
- https://github.com/radareorg/radare2/commit/669a404b6d98d5db409a5ebadae4e94b34ef5136 x_refsource_MISC