CVE-2022-1649: radare radare2 NULL Pointer Dereference
Vulnerability summary
CVE-2022-1649 is a high (CVSS 7.6) NULL Pointer Dereference vulnerability in radare radare2. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).
CVSS metrics
6 scores · 3 sources · 3 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
- NVDNIST7.6HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.01 pp
From 0.70% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Radare1 product
- radare2< 5.7.0
Radareorg1 product
- radareorg/radare2≥ unspecified, < 5.7.0
Ubuntu1 product
- radare2All versions (No fix recorded)
3 vendors · 3 products
References
4 links- huntr.dev/bounties/c07e4918-cf86-4d2e-8969-5fb63575b449X Refsource CONFIRMREPORTExploitThird Party Advisory
- github.com/radareorg/radare2/commit/a5aafb99c3965259c84ddcf45a91144bf7eb4cf1X Refsource MISCREPORTPatchThird Party Advisory