CVE-2025-60358
📋 TL;DR
A memory leak vulnerability exists in radare2's _load_relocations function in versions 5.9.8 and earlier. This vulnerability allows attackers to cause resource exhaustion by repeatedly triggering the vulnerable function, potentially leading to denial of service. Users of radare2 reverse engineering framework are affected.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could exhaust system memory, causing radare2 to crash or become unresponsive, potentially disrupting reverse engineering workflows or automated analysis systems.
Likely Case
Degraded performance during analysis of specially crafted binaries, with possible application crashes after prolonged use.
If Mitigated
Minimal impact with proper resource limits and monitoring in place; isolated to radare2 process only.
🎯 Exploit Status
Exploitation requires ability to feed specially crafted binaries to radare2; no known public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.9 or later
Vendor Advisory: https://github.com/radareorg/radare2/pull/24224
Restart Required: No
Instructions:
1. Update radare2 to version 5.9.9 or later using your package manager. 2. For source installations: git pull from official repository and rebuild. 3. Verify installation with 'r2 -v'.
🔧 Temporary Workarounds
Limit memory usage
Unix-likeSet resource limits on radare2 processes to prevent memory exhaustion
ulimit -v 1048576
r2 [binary]
🧯 If You Can't Patch
- Avoid analyzing untrusted binaries with radare2
- Monitor radare2 memory usage and restart if excessive consumption detected
🔍 How to Verify
Check if Vulnerable:
Run 'r2 -v' and check if version is 5.9.8 or earlierCheck Version:
r2 -v | grep radare2Verify Fix Applied:
Run 'r2 -v' and confirm version is 5.9.9 or later📡 Detection & Monitoring
Log Indicators:
- High memory usage by radare2 processes
- radare2 crash logs with memory allocation failures
Network Indicators:
- Not applicable - local tool
SIEM Query:
process_name:"r2" AND memory_usage > 90%