CVE-2023-47016

Name of the Vulnerable Software and Affected Versions radare2 version 5.8.9

Description The issue is an out-of-bounds read in the r bin object set items function located in libr/bin/bobj.c, which causes a crash in the r read le32 function in libr/include/r endian.h.

Recommendations For radare2 version 5.8.9, consider restricting access to the r bin object set items function until a patch is available. As a temporary workaround, avoid using the r read le32 function in libr/include/r endian.h to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.