CVE-2026-8695
High · 7.5CVSS
7.5
EPSS
1.1%
Published
May 15, 2026
CISA due date
—
The record
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response. Attackers can exploit this vulnerability through GDB remote debugging to cause a denial of service or potentially achieve code execution by manipulating thread list processing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | radare2 | 0 | 6.1.4-2.1 |
Related vulnerabilities
- CVE-2026-40499 radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB… Also affects radare2
- CVE-2024-29645 Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute… Also affects radare2
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-416
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-416
- CVE-2026-112402 Pillow is a Python imaging library. CWE-416
- CVE-2026-112396 Pillow is a Python imaging library. CWE-416
- CVE-2025-55654 A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of… CWE-416
- CVE-2026-17591 A flaw was found in libarchive. CWE-416