radareorg radare2 up to version 6.1.6 contains an integer overflow in the function r_str_word_get0set located in libr/util/str.c. The flaw leads to a signed or unsigned integer overflow when processing certain string inputs. An attacker can trigger the overflow by providing crafted input, which can corrupt memory or cause the program to crash, potentially allowing local disruption or tampering with program state.

All radareorg radare2 releases up to version 6.1.6 are affected. The vulnerability resides in the string manipulation library and is triggered by the r_str_word_get0set function.

The CVSS score of 4.8 indicates a moderate severity impact. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack is local, the required access is limited to a user who can supply input to r_str_word_get0set. If successful, the attacker could achieve memory corruption or a denial of service by exploiting the integer overflow.