A stack-based buffer overflow has been identified in the MDMP format parser of radare2, specifically within the Memory64ListStream component. The vulnerability arises from insufficient bounds checking on a local buffer, which can be triggered by malicious manipulation of MDMP data. While the CVE notes that the exploit is publicly available and may be used, it does not explicitly state the outcome; however, a stack overflow of this type typically allows an attacker to corrupt control data, potentially leading to arbitrary code execution or process termination if local privileges are present.

All radareorg radare2 releases up and including version 6.1.6 are affected. The flaw resides in the standard MDMP parser shipped with these versions. Systems running any of these releases are vulnerable when MDMP parsing is enabled.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The issue requires local access to supply malicious MDMP data and is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the public availability of an exploit and the presence of a stack overflow warrant a patch as soon as possible.