CVE-2026-8696: radare2 6.1.5 Use-After-Free via gdbr_pids_list()
radare2 6.1.5 contains a use-after-free vulnerability in the gdbrpidslist() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
radare2from your environment.Uninstall radare2 6.1.5 or otherwise stop using this vulnerable build until a patched/fixed version is made available.
- Compensating control
Prevent radare2 from communicating with untrusted remote GDB servers and block or restrict network access that could deliver malformed thread information responses (e.g., via firewall rules, network ACLs, or host-based firewall) to avoid triggering the gdbr_pids_list() use-after-free.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8696?
CVE-2026-8696 is classified as a high severity vulnerability due to its potential for remote denial of service and arbitrary code execution.
How do I fix CVE-2026-8696?
To fix CVE-2026-8696, update radare2 to version 6.1.6 or later, which contains the necessary patches.
What is the impact of CVE-2026-8696?
The impact of CVE-2026-8696 includes the potential for remote attackers to crash the application or execute arbitrary code.
Who is affected by CVE-2026-8696?
CVE-2026-8696 affects users running radare2 version 6.1.5.
What is the nature of the vulnerability in CVE-2026-8696?
CVE-2026-8696 is a use-after-free vulnerability found in the gdbr_pids_list() function of radare2.