The affected code resides in the r_str_ndup/r_str_append functions of libr/util/str.c inside radareorg’s radare2. The functions calculate a new string length from input without bounds checking, which can trigger an integer overflow when supplied with oversized data. This overflow can lead to an incorrect memory allocation and thus corrupt heap data. The description notes that the exploit has been publicly disclosed and may be used; the potential for arbitrary code execution is inferred from the possibility of control‑flow corruption but is not explicitly stated in the advisory.

The vulnerable product is radare2 by radareorg, versions up to and including 6.1.6 are affected. An official fix is implemented in commit a20a56917ae85d732e683f8d9078bdcfee incorporated in all releases that follow that commit, starting with 6.1.7.

The base score of 4.8 indicates moderate severity, and the EPSS score of less than 1% implies a low likelihood; it is not listed in the CISA KEV catalog. The attack vector is inferred to be local because the description explicitly states that an attack has to be approached locally. Thus, an attacker must run radare2 locally and supply crafted input; the risk exposure is confined to environments where untrusted users can execute the binary.