{"id":"CVE-2021-32613","details":"In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.","modified":"2026-08-07T17:28:08.519991Z","published":"2021-05-14T13:15:07.377Z","related":["openSUSE-SU-2024:11295-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"33"},{"last_affected":"33"},{"introduced":"34"},{"last_affected":"34"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3LPB5VGCIA7WA55FSB3YZQFUGZKWD7O/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3S7JB46PONPHXZHIMR2XDPLGJCN5ZIX/"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959939"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c07072861942dd80c6b6d62"},{"type":"FIX","url":"https://github.com/radareorg/radare2/issues/18666"},{"type":"FIX","url":"https://github.com/radareorg/radare2/issues/18667"},{"type":"FIX","url":"https://github.com/radareorg/radare2/issues/18679"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"last_affected":"ee753c25094c6e1c62dfb9596423824251dbc943"},{"fixed":"5e16e2d1c9fe245e4c17005d779fde91ec0b9c05"},{"fixed":"a07dedb804a82bc01c07072861942dd80c6b6d62"}],"database_specific":{"cpe":"cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c07072861942dd80c6b6d62","target":{"file":"libr/bin/p/bin_mach0.c"},"deprecated":false,"digest":{"line_hashes":["211921345178114093370428947692498009900","154239016323387656120110791473062974521","197634429748365036978182416865077052005","211074051710044500989675597504644777329","217178479459434555199088203652955891060"],"threshold":0.9},"id":"CVE-2021-32613-2834f321"},{"signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05","target":{"file":"libr/bin/format/pyc/marshal.c","function":"get_none_object"},"deprecated":false,"digest":{"function_hash":"281144442903635776283408469084151380870","length":228},"id":"CVE-2021-32613-89e7b878","signature_type":"Function"},{"id":"CVE-2021-32613-e60a11fd","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05","target":{"file":"libr/bin/format/pyc/marshal.c"},"deprecated":false,"digest":{"line_hashes":["293727422535202617895383407783017198569","325426534639164205903082921648749687711","228831602891691957477592427643617201977","224186186095923557659101101390381017579","212850913520644578786064218748185165524","172004653938665698361432276404790548809","26425263749308728204585716171309190508","149829655951370627201221230733046478701","246419025862705036512837914482105705955","228127056506232150828101904703011610912"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05","target":{"file":"libr/bin/format/pyc/marshal.c","function":"get_object"},"deprecated":false,"digest":{"length":2432,"function_hash":"152887779541464158850990740854948468430"},"id":"CVE-2021-32613-f6dc3e9a"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32613.json","vanir_signatures_modified":"2026-08-07T17:28:08Z"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}