The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call.

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (rreadle16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.

The sdbsetinternal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in rbindwarfparsecompunit in libr/bin/dwarf.c.