{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21988-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for radare2\n\nThis update for radare2 fixes the following issues:\n\nChanges in radare2:\n\n- Update to version 6.2.2:\n  * Analysis: new JNI plugin with typed interface tables, arm64\n    Swift float calling conventions, DWARF prototype linking,\n    jump-table and switch-case fixes\n  * Core: fix RAnalOp leaks in disasm/diff/debug loops, aoj memory\n    use, partial-read handling, fp variable recovery\n  * Bundle sdb 2.5.2 (upstream pin): rename shlib to libsdb2_5_2\n  * Details can be found here:\n    https://github.com/radareorg/radare2/releases/tag/6.2.2\n\n- Security issues fixed:\n  * CVE-2026-81886: Validate dmp64 page counts against dump size\n    (boo#1282346).\n  * CVE-2026-81885: Fix infinite loop in the NE fixup parser\n    (boo#1282345).\n  * CVE-2026-81884: Validate Mach-O LC_DATA_IN_CODE ranges\n    (boo#1282344).\n  * CVE-2026-81883: Fix Lua function parser OOB reads (boo#1282343).\n  * CVE-2026-81882: Fix bplist Unicode string conversion (boo#1282342).\n  * CVE-2026-81881: Fix Swift Mach-O field metadata bounds check\n    (boo#1282341).\n  * CVE-2026-81880: Decode PEF relocs lazily, add more bounds and\n    overflow checks (boo#1282340).\n  * CVE-2026-81879: Fix oobread in ELF PN_XNUM phdr count handling\n    (boo#1282339).\n  * CVE-2026-81878: Fix heap write overflow in Python loader\n    (boo#1282338).\n  * CVE-2026-14788: Denial of Service via use-after-free in\n    r_core_bin_load function (boo#1270453).\n  * CVE-2026-14761: Denial of service via integer overflow in string\n    manipulation functions (boo#1270452).\n  * CVE-2026-14760: Denial of Service via local use-after-free\n    vulnerability (boo#1270450).\n  * CVE-2026-14759: Denial of Service via heap-based buffer overflow\n    (boo#1270449).\n  * CVE-2026-14758: Denial of Service via integer overflow in hexpairs\n    parser (boo#1270447).\n  * CVE-2026-14757: Integer overflow allows local impact (boo#1270445).\n  * CVE-2026-40527: Command injection vulnerability in the afsv/afsvj\n    (boo#1262336).\n  * CVE-2026-4174: Missing validation against an upper limit when\n    allocating memory in the Mach-O file parser can lead to excessive\n    resource consumption (boo#1259722).\n- Security issue fixed with the previous release:\n  * CVE-2026-41015: Configured on UNIX without SSL, allows command\n    injection via a PDB name to rabin2 (boo#1262190).\n  * CVE-2026-40517: Crafted PDB file with newline characters in symbol\n    names can allow to inject arbitrary commands (boo#1262680).\n  * CVE-2026-8695: UAFs in the gdb remote protocol ##crash (boo#1265403).","dates":{"published":"2026-09-25T08:25:52.000Z","modified":"2026-10-01T18:23:10.943Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"radare2&distro=openSUSE Leap 16.0","name":"radare2","label":"radare2&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/radare2&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 6.2.2-bp160.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.2.2-bp160.1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1259722","label":"bugzilla.suse.com/1259722","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262190","label":"bugzilla.suse.com/1262190","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262336","label":"bugzilla.suse.com/1262336","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1262680","label":"bugzilla.suse.com/1262680","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1265403","label":"bugzilla.suse.com/1265403","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270445","label":"bugzilla.suse.com/1270445","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270447","label":"bugzilla.suse.com/1270447","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270449","label":"bugzilla.suse.com/1270449","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270450","label":"bugzilla.suse.com/1270450","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270452","label":"bugzilla.suse.com/1270452","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270453","label":"bugzilla.suse.com/1270453","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282338","label":"bugzilla.suse.com/1282338","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282339","label":"bugzilla.suse.com/1282339","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282340","label":"bugzilla.suse.com/1282340","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282341","label":"bugzilla.suse.com/1282341","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282342","label":"bugzilla.suse.com/1282342","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282343","label":"bugzilla.suse.com/1282343","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282344","label":"bugzilla.suse.com/1282344","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282345","label":"bugzilla.suse.com/1282345","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1282346","label":"bugzilla.suse.com/1282346","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14757","label":"www.suse.com/security/cve/CVE-2026-14757","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14758","label":"www.suse.com/security/cve/CVE-2026-14758","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14759","label":"www.suse.com/security/cve/CVE-2026-14759","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14760","label":"www.suse.com/security/cve/CVE-2026-14760","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14761","label":"www.suse.com/security/cve/CVE-2026-14761","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14788","label":"www.suse.com/security/cve/CVE-2026-14788","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40517","label":"www.suse.com/security/cve/CVE-2026-40517","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40527","label":"www.suse.com/security/cve/CVE-2026-40527","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41015","label":"www.suse.com/security/cve/CVE-2026-41015","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4174","label":"www.suse.com/security/cve/CVE-2026-4174","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81878","label":"www.suse.com/security/cve/CVE-2026-81878","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81879","label":"www.suse.com/security/cve/CVE-2026-81879","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81880","label":"www.suse.com/security/cve/CVE-2026-81880","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81881","label":"www.suse.com/security/cve/CVE-2026-81881","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81882","label":"www.suse.com/security/cve/CVE-2026-81882","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81883","label":"www.suse.com/security/cve/CVE-2026-81883","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81884","label":"www.suse.com/security/cve/CVE-2026-81884","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81885","label":"www.suse.com/security/cve/CVE-2026-81885","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81886","label":"www.suse.com/security/cve/CVE-2026-81886","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8695","label":"www.suse.com/security/cve/CVE-2026-8695","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-14757","CVE-2026-14758","CVE-2026-14759","CVE-2026-14760","CVE-2026-14761","CVE-2026-14788","CVE-2026-40517","CVE-2026-40527","CVE-2026-41015","CVE-2026-4174","CVE-2026-81878","CVE-2026-81879","CVE-2026-81880","CVE-2026-81881","CVE-2026-81882","CVE-2026-81883","CVE-2026-81884","CVE-2026-81885","CVE-2026-81886","CVE-2026-8695"],"downstream":[],"duplicates":[],"related":["CVE-2026-14757","CVE-2026-14758","CVE-2026-14759","CVE-2026-14760","CVE-2026-14761","CVE-2026-14788","CVE-2026-40517","CVE-2026-40527","CVE-2026-41015","CVE-2026-4174","CVE-2026-81878","CVE-2026-81879","CVE-2026-81880","CVE-2026-81881","CVE-2026-81882","CVE-2026-81883","CVE-2026-81884","CVE-2026-81885","CVE-2026-81886","CVE-2026-8695"]},"timeline":[{"kind":"published","date":"2026-09-25T08:25:52.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-01T18:23:10.943Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T12:08:47.354Z","stale":false,"partial":false}}