CVE-2026-8695: radare2 6.1.5 Use-After-Free via gdbr_threads_list()
radare2 6.1.5 contains a use-after-free vulnerability in the gdbrthreadslist() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
radare2from your environment.Uninstall radare2 or remove/disable components that provide GDB remote debugging if the software is not required until a security fix is available.
- Configuration
Disable radare2's GDB remote debugging support or avoid starting the built-in GDB remote server to prevent processing of qfThreadInfo/qsThreadInfo responses.
radare2 GDB remote debugging = disabled - Compensating control
Restrict access to any GDB remote debugging ports or services via firewall/ACLs to trusted management networks only; do not expose GDB remote debugging to untrusted networks.
- Compensating control
Perform GDB remote debugging only within isolated/trusted environments (for example, on an internal VPN or air-gapped network) to reduce exposure to remote attackers.
- Operational
Monitor radare2 project advisories for a security fix and apply vendor-supplied updates when a fixed version is released; until then, avoid enabling GDB remote debugging.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8695?
CVE-2026-8695 is classified as a high-severity vulnerability due to its potential to cause remote memory corruption.
How do I fix CVE-2026-8695?
To fix CVE-2026-8695, users should upgrade to radare2 version 6.1.6 or later where the vulnerability is addressed.
What is the impact of CVE-2026-8695?
CVE-2026-8695 can allow remote attackers to exploit memory corruption, potentially leading to arbitrary code execution.
Who is affected by CVE-2026-8695?
CVE-2026-8695 affects users of radare2 version 6.1.5.
What is the cause of CVE-2026-8695?
CVE-2026-8695 is caused by a use-after-free vulnerability in the gdbr_threads_list() function when handling specific responses.