CyberRota Analysis
AI-GeneratedThe radare2 reverse engineering framework is vulnerable in versions prior to 6.2.0 due to a flaw in its Mach-O Swift field-metadata parser, which can lead to incorrect metadata processing or process termination when parsing specially crafted Mach-O files. Although the impact is classified as low and no memory disclosure has been observed, users of radare2 should prioritize upgrading to version 6.2.0 to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)