CVE-2024-29645

What it actually does

Buffer overflow in the parse_die function permits an attacker to overwrite memory and execute arbitrary code.

Why it matters to the business

Attackers could gain control of systems running the affected reverse-engineering tool, potentially leading to data theft, malware deployment, or further network compromise; the issue has been public for many months with a fixed version available.

How an attack unfolds

An attacker supplies a specially crafted binary or debug information file that reaches the parse_die function, triggering the buffer overflow and allowing shellcode execution in the context of the radare2 process.

How to fix it

Upgrade radareorg/radare2 to the commit 72bf3a486fa851797aa21887a40ba0e3d3a6d620 or later; rebuild and redeploy any dependent tooling or containers.

How to confirm the fix worked

Confirm the installed version reports a commit newer than 72bf3a486fa851797aa21887a40ba0e3d3a6d620; re-test parsing of known trigger files to verify the crash no longer occurs.

Typical attack path

1. Locate or obtain a target system running radare2 5.8.8 or earlier
2. Prepare a malicious input file designed to overflow the parse_die buffer
3. Open the file with radare2, causing the vulnerable function to be invoked
4. Leverage the resulting memory corruption to execute attacker-controlled code

How to detect it

Review radare2 process crash logs and core dumps for signs of memory corruption near parse_die; inspect command history or automation logs for unexpected file loads after the vulnerability disclosure date.

What your security team should do

• Immediately update all radare2 installations to the fixed commit
• Scan build pipelines and developer workstations for the vulnerable version
• Restrict use of untrusted binaries with radare2 until patched
• Monitor for any new public exploit code targeting this function