CVE-2024-26475

What it actually does

The vulnerability allows a local attacker to trigger a crash or denial of service in radare2 by supplying crafted input that reaches the grub_sfs_read_extent function.

Why it matters to the business

Organizations using radare2 for binary analysis or reverse engineering may experience workflow interruptions when the tool crashes on untrusted inputs, with low urgency given the age of the issue and absence from known exploited lists.

How an attack unfolds

An attacker with local access supplies a specially crafted file or input to radare2 that exercises the vulnerable grub_sfs_read_extent path, causing the process to terminate unexpectedly.

How to fix it

Upgrade radare/radare2 to commit ea7f0356519884715cf1d5fba16042bac72b2df5 or later; for AlmaLinux 8 users, ensure perl-Math-BigInt is at version 1:1.9998.11-7.el8 or newer.

How to confirm the fix worked

Verify the installed radare2 version is 5.8.8 or newer (or the listed commit) and test that the previously crashing input no longer causes a denial of service.

Typical attack path

1. Obtain local access to a system running vulnerable radare2
2. Prepare input that triggers the grub_sfs_read_extent function
3. Invoke radare2 with the malicious input
4. Observe process crash resulting in denial of service

How to detect it

Examine application or system logs for unexpected radare2 process terminations when processing files; no widespread in-the-wild exploitation indicators are known.

What your security team should do

• Prioritize upgrade of radare2 installations to the fixed commit within standard change windows
• Review any automated pipelines or analyst workstations that invoke radare2 on untrusted files
• Monitor EPSS and KEV status for changes in exploit availability