The vulnerability resides in radare2, specifically in the hexpairs parser’s cmd_anal_opcode function within libr/core/cmd_anal.inc.c. Unsigned integer overflows can occur when this function processes crafted input, leading to corrupted internal counters or array sizes. The resulting memory corruption could allow a local user to disrupt normal operation or potentially trigger a denial‑of‑service condition. This weakness is classified under CWE‑189 and CWE‑190, both describing integer overflow issues.

Any installation of radare2 up to and including version 6.1.6 is affected. Radare2 is an open‑source reverse‑engineering framework, and the flaw affects the system if the hexpairs parser receives input from local users.

With a CVSS score of 4.8, the vulnerability poses a moderate risk but the EPSS score indicates a very low likelihood of exploitation. The flaw requires local access and is not listed in CISA's KEV catalog. Public exploit code is available, allowing a local attacker who can inject crafted input into the hexpairs parser to trigger memory corruption and cause a denial‑of‑service. The impact is limited to the system running radare2 and would not remotely compromise integrity or confidentiality of other hosts.