radare.org radare2 contains an integer overflow bug in the r_str_word_get0set function located in libr/util/str.c. The flaw is triggered by crafted string inputs that cause a signed or unsigned overrun (CWE‑189, CWE‑190). When the overflow occurs, the program may corrupt its stack or heap memory, leading to unpredictable behavior, crashes, or the potential for attacker‑controlled data to influence subsequent operations.

All radare.org radare2 releases up to and including version 6.1.6 are affected. The vulnerability resides in the string manipulation library and is caused by the r_str_word_get0set routine.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Because the attack is local, an adversary must have the ability to supply input to the vulnerable function—typically by running radare2 or a script that invokes it. Successful exploitation could lead to memory corruption or a denial‑of‑service condition within the affected process.