The vulnerability in radare2 concerns the Windows 64‑bit crash‑dump (dmp64) parser, where it uses an input‑controlled PageCount value directly to bound a per‑page memory allocation loop. Because the parser does not validate that PageCount does not exceed the actual size of the dump, a specially crafted full‑memory crash dump can force radare2 to repeatedly allocate and append page descriptors, rapidly exhausting system memory and causing a denial of service. This weakness is classified as CWE‑770 (Unchecked Memory Allocation). No arbitrary code execution or confidentiality breach results from the flaw; the practical consequence is service interruption due to excessive memory consumption.

This issue affects the radareorg:radare2 product on Windows 64‑bit platforms for all versions earlier than 6.2.0. The vulnerability is specific to the dmp64 parser component used to read Windows crash dump files. Users who run older radare2 binaries and open or load such dump files are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is unavailable, so the current evidence does not suggest a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted dump file to a local user or an application that automatically processes dumps, making the attack vector likely local or via a compromised user. Because the flaw results in memory exhaustion rather than code execution, the risk is limited to denial of service, but it can have significant impact in environments where radare2 is used for automated analysis or reverse engineering.