CVE-2017-16357: Radare RADARE2

High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days.

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.

Affected products

• Radare RADARE2: version 2.0.1 only

Published 2017-11-01. Last modified 2026-06-17.