CVE-2021-32495

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
radare2	radare2	radare2 5.3.0-git 26142

References

https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05Patch, Vendor Advisory
https://github.com/radareorg/radare2/issues/18666Issue Tracking, Patch, Vendor Advisory
https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05Patch, Vendor Advisory
https://github.com/radareorg/radare2/issues/18666Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jul 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324965.3SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH i CVE-2021-324978.6SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user CVE-2021-324988.6SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary ex CVE-2021-324997.5SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable CVE-2021-325034.9Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325045.3Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325066.5Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via CVE-2021-325076.5Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files CVE-2021-325086.5Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by CVE-2021-325104.3QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary d CVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direc