CVE-2025-63744
📋 TL;DR
A NULL pointer dereference vulnerability in radare2's bin_dyldcache.c load() function allows attackers to crash the program by processing a malicious file. This affects radare2 versions 6.0.5 and earlier. Users who analyze untrusted files with radare2 are vulnerable to denial of service.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through program crash, potentially disrupting reverse engineering workflows or automated analysis pipelines.
Likely Case
Program crash when processing specially crafted files, requiring manual restart and potentially losing unsaved work.
If Mitigated
No impact if radare2 is not used to process untrusted files or if patched version is installed.
🎯 Exploit Status
Exploitation requires only a crafted file to trigger the crash. The advisory includes technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit e37e15d10fd8a19c3e57b3d7735a2cfe0082ec79 and later versions
Vendor Advisory: https://github.com/radareorg/radare2/issues/24661
Restart Required: No
Instructions:
1. Update radare2 to latest version from official repository. 2. Rebuild from source if using compiled version. 3. Verify fix with version check.
🔧 Temporary Workarounds
Avoid processing untrusted dyldcache files
allDo not use radare2 to analyze untrusted or suspicious dyldcache files that could trigger the vulnerability.
🧯 If You Can't Patch
- Restrict radare2 usage to trusted files only
- Implement file validation/sandboxing for radare2 processes
🔍 How to Verify
Check if Vulnerable:
Check radare2 version with 'r2 -v' and verify if it's 6.0.5 or earlier.Check Version:
r2 -v | grep -i versionVerify Fix Applied:
Verify radare2 version is newer than 6.0.5 or includes commit e37e15d10fd8a19c3e57b3d7735a2cfe0082ec79.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs from radare2 processes
- Unexpected radare2 process termination
SIEM Query:
process_name:"radare2" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-002-radare2-nullptr-deref-bin_dyldcache.md
- https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_dyldcache.md
- https://github.com/radareorg/radare2/commit/e37e15d10fd8a19c3e57b3d7735a2cfe0082ec79
- https://github.com/radareorg/radare2/issues/24661
