A local integer overflow flaw in radare2’s core_anal_bytes function can be triggered by manipulating specific input data. The overflow may corrupt memory adjacent to the overflowed buffer, leading to a crash or, if the attacker can control the overflow, unauthorized code execution. The vulnerability is identified as CWE-189 and CWE-190, confirming its root cause is improper handling of signed and unsigned integer values.

radareorg radare2 versions up to 6.1.6 are affected; users running these versions without applying the available patch are vulnerable.

The attack requires local execution and the CVSS score of 4.8 indicates moderate severity. The EPSS score of < 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. While the integer overflow could corrupt memory, no widespread exploitation has been observed, but the risk warrants remediation.