Rizin, a UNIX‑like reverse engineering framework, contains a heap‑buffer‑overflow in the OMF parser located in librz/bin/format/omf/omf.c. This flaw can corrupt adjacent heap memory and may lead to a crash or, in some execution contexts, arbitrary code execution. The weakness is classified as CWE‑125, a classic out‑of‑bounds read that can be leveraged to corrupt data structures, undermining integrity and stability of the application.

The vulnerability affects any installation of the rizinorg:rizin product that includes the unpatched OMF parsing code. No specific version range is listed in the CNA data, so all released versions containing the old omf.c code are susceptible until the fix is applied.

The CVSS score of 3.3 indicates low severity, and no EPSS estimate is available, suggesting limited projected exploitation activity. The vulnerability is not yet catalogued in CISA’s KEV list. Based on the description, the attack vector is likely local: an attacker who can supply a crafted OMF file to the Rizin tool is able to trigger the overflow. External exploitation would require a medium‑to‑high skill level to craft a malicious file and trigger the parser within a session that has sufficient privileges.