{"id":"CVE-2023-4322","summary":"Heap-based Buffer Overflow in radareorg/radare2","details":"Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.","modified":"2026-08-12T14:51:11.025180Z","published":"2023-08-14T15:27:40.797Z","database_specific":{"cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4322.json","cna_assigner":"@huntrdev"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/06e2484c-d6f1-4497-af67-26549be9fffd"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/64KUV6OGEVQ75QOV35PUVVDOJTKSJHYN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOZ6XCADVAPAIHMVSV3FUAN742BHXF55/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4322.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4322"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"ba919adb74ac368bf76b150a00347ded78b572dd"}],"database_specific":{"cpe":"cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.8.8"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.8.8","5.8.6","5.8.4","5.8.2","5.8.0","5.7.8","5.7.6","5.7.4","5.7.2","5.7.0","wip","5.6.8","5.6.6","5.6.4","5.6.2","5.6.0","5.5.4","5.5.2","5.5.0","5.4.2","5.4.0","5.4.0-git","5.3.1","5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"vanir_signatures_modified":"2026-08-12T14:51:11Z","vanir_signatures":[{"source":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd","target":{"file":"libr/arch/p/bf/plugin.c"},"deprecated":false,"digest":{"line_hashes":["70975428532164984714734001805611696778","281486453657383326282345809526645828371","136443092440367198260519913648323892475","172432825843632095074184426177369209618","285683610766217328212400237130274330976","339039093838111441381689919772168726181","6164575971691892048970204066806206736","193501872350762745441713964186043831438","86013817836321140267067976052760026303","281250614418785598690862199898853774965","338219661510948954752915641760415756364","74173355351713198084506559991350898609","321039791683442481135310492927335021732","144116308253468402779701604220302508579","55304811120904052710776036392277307200","127495418610636845687417377562423612122","143738124787371077077367867285877620279","36329866692358485825235026154102020563","85245237493164594689952636301168923381","249306469437960120794837877188116569403","329060711963239734931009819944930413749","167918259540984817960300823773941708468","87841021276321431481024481527742430446","4599934928883796311120574861961240011","252436231134655364521582190701448631186","131525237392137151385640350978237708231","261825994753514711751854082748682207292","246787279953792620562468568645788570909","280480730394141214568241380981511291677","261827673308526632408631883157003579366","114016295987331771615224857497991335550","35942735766237632458322803903886307095","195920300085084351743410623643691369265","962633846714113159013474463822114191","820818393439162154710112149024843393","275361165644329124012460161955046061947","326968572619182191111523228615733555635","81800801273135994332995170653104924736","261258903464982202257671899271820528655","210983966991662840618420796304163120668","312861855851895839350389862268132987550","151841650274195315898865268306358904273","233683423100223564543864728834068543819","69703223218286246593127015455423352516"],"threshold":0.9},"id":"CVE-2023-4322-3cd16233","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"317036279355911307044951098509291178812","length":284},"id":"CVE-2023-4322-7edc7910","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd","target":{"file":"libr/core/cmd_anal.c","function":"cmd_sdbk"}},{"deprecated":false,"digest":{"function_hash":"56709723305386515566753658278114090348","length":154},"id":"CVE-2023-4322-8e81fb62","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd","target":{"file":"libr/arch/p/bf/plugin.c","function":"getid"}},{"digest":{"line_hashes":["100919866650922701096030271996020903390","281697327789164066655910787024067956789","195232266480425962896334778074437382522","62334830968509594441970909382527887822","10933333910054769337327122289019623093","64531578258249099685529461561717026878","104406053970517472665047226957544074320","78774399741007068674078949182695391161","102699036116126716188213805276138335374","199951899363871218402288144373373624713","19855704920881650024145903862631408726","338734315967355717630126733542707839414","124105193170296740912998195622736396924","155655288283191295395352397619018852550","335151701504423863959470734041942642095","319703695329864413107007393354485168260","166920462247501538049617469858404613325","291136382365276109382357418790887489140","240031948630166019291278460176486930114"],"threshold":0.9},"id":"CVE-2023-4322-927e9e9e","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd","target":{"file":"libr/core/cmd_anal.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/ba919adb74ac368bf76b150a00347ded78b572dd","target":{"file":"libr/arch/p/bf/plugin.c","function":"decode"},"deprecated":false,"digest":{"length":2923,"function_hash":"24827625557496038947819277453339472449"},"id":"CVE-2023-4322-d932b35b"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4322.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"}]}