A heap-based buffer overflow exists in the function r_bin_java_inner_classes_attr_calc_size within radare2’s RBinJava Line Number Table parser. When a crafted Java class file is parsed, the overflow can overwrite adjacent heap memory. This memory corruption could allow an attacker to execute arbitrary code or trigger a crash, resulting in denial of service. The vulnerability relies on local access and requires that radare2 process a malicious Java class file.

The flaw affects radareorg radare2 versions up to and including 6.1.6. It targets the shlr/java/class.c component of the RBinJava parser, a core part of the radare2 binary analysis framework. Users deploying these versions are at risk.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local approach: a malicious Java class file must be processed by radare2. Since the exploit has been publicly released, any user running the affected radare2 version could trigger the overflow, potentially leading to code execution or a denial of service.