CVE-2022-1649

Published: May 10, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).

Affected (1)

Products: Radare: Radare2

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Radare Radare2	Before 5.7.0

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (4)

https://github.com/radareorg/radare2/commit/a5aafb99c3965259c84ddcf45a91144bf7eb4cf1

Source: security@huntr.dev

PatchThird Party Advisory

https://huntr.dev/bounties/c07e4918-cf86-4d2e-8969-5fb63575b449

Source: security@huntr.dev

ExploitThird Party Advisory

https://github.com/radareorg/radare2/commit/a5aafb99c3965259c84ddcf45a91144bf7eb4cf1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://huntr.dev/bounties/c07e4918-cf86-4d2e-8969-5fb63575b449

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.