CVE-2026-8696

Name of the Vulnerable Software and Affected Versions radare2 version 6.1.5

Description A use-after-free issue exists in the gdbr pids list() function within the GDB client core. Remote attackers can cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. The issue is triggered when qsThreadInfo fails after qfThreadInfo has successfully allocated RDebugPid structures, leading to double-free memory corruption during the error path cleanup process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.