How many CVEs have a located fix in radareorg/radare2?

101 published CVEs have a fix traced to functions in radareorg/radare2, touching 228 functions across 89 files.

Which function in radareorg/radare2 has been patched by the most CVEs?

r_bin_ne_get_relocs in libr/bin/format/ne/ne.c has been changed by 4 CVE fixes, from 2022 to 2026.

How large is a typical CVE fix in radareorg/radare2?

The median fix changes 12 lines. 65% of fixes change 20 lines or fewer, and 46% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

#36 of 500 repositories

radareorg/radare2

Name: radareorg/radare2: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 22, 2026

101

CVE fixes located

Published CVEs

228

Functions patched

Distinct function sites

89

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

101 published CVEs have a fix traced to functions in radareorg/radare2, the earliest published in 2017. Those fixes changed 228 distinct functions across 89 files, in 895 patch hunks.

Among the 500 repositories tracked here, radareorg/radare2 ranks #36 by the number of CVEs with a located fix.

Most patched functions

Functions in radareorg/radare2 changed by the most CVE fixes.

Most patched files

Files in radareorg/radare2 changed by the most CVE fixes.

1libr/bin/format/ne/ne.c9 CVEs · 9 functions
2shlr/java/class.c7 CVEs · 22 functions
3libr/bin/format/pyc/marshal.c5 CVEs · 8 functions
4libr/bin/format/mach0/mach0.c5 CVEs · 6 functions
5libr/bin/dwarf.c4 CVEs · 8 functions
6libr/bin/p/bin_dyldcache.c4 CVEs · 5 functions
7libr/util/str.c4 CVEs · 5 functions
8libr/core/canal.c4 CVEs · 4 functions
9libr/io/io_bank.c4 CVEs · 3 functions
10libr/core/cmd_anal.c3 CVEs · 6 functions

Fix size

How much code a CVE fix in radareorg/radare2 changes, with backports counted once.

12

Median lines changed

Added plus removed, per CVE

65%

Fixes of 20 lines or fewer

Share of CVE fixes

46%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in radareorg/radare2, and the functions each fix changed.

radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode
CVE-2026-81883lua53parseFunction
Low · CVSS 3.3
EPSS 0.2%2026-09-22
radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser
CVE-2026-81885r_bin_ne_get_relocs
Medium · CVSS 5.5
EPSS 0.1%2026-09-22
radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
CVE-2026-81882parse_unicode_node
Medium · CVSS 6.1
EPSS 0.1%2026-09-22
radare2: Uncontrolled memory allocation in radare2 dmp64 parser
CVE-2026-81886r_bin_dmp64_init_memory_runs r_bin_dmp64_init_bmp_header r_bin_dmp64_init
Medium · CVSS 5.5
EPSS 0.1%2026-09-22
radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
CVE-2026-81884init_items
Low · CVSS 3.3
EPSS 0.2%2026-09-22
radare2: Uncontrolled resource consumption in radare2 PEF loader
CVE-2026-81880do_reloc_bytecode load push_reloc
Medium · CVSS 5.5
EPSS 0.1%2026-09-22
radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
CVE-2026-81879init_phdr init_dynamic_section _process_verneed_state
Medium · CVSS 6.1
EPSS 0.2%2026-09-22
radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
CVE-2026-81878get_complex_object get_long_object get_bytes
Medium · CVSS 5.5
EPSS 0.2%2026-09-22
radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
CVE-2026-81881parse_type
Medium · CVSS 4.4
EPSS 0.1%2026-09-22
radareorg radare2 str.c r_str_word_get0set integer overflow
CVE-2026-14786r_str_word_get0set
Medium · CVSS 4.8
EPSS 0.2%2026-07-06
radareorg radare2 str.c r_str_append integer overflow
CVE-2026-14761r_str_prepend r_str_append
Medium · CVSS 4.8
EPSS 0.2%2026-07-05
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
CVE-2026-14760r_core_disasm_pde pde_refresh_pc
Medium · CVSS 4.8
EPSS 0.2%2026-07-05

Get an alert for each new radareorg/radare2 CVE, with the patched functions and AI-written analysis.

Monitor radare2 CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

openssl/openssl101 CVEs craftcms/cms103 CVEs mantisbt/mantisbt103 CVEs InternationalColorConsortium/iccDEV104 CVEs thorsten/phpmyfaq106 CVEs chamilo/chamilo-lms95 CVEs rails/rails94 CVEs nextcloud/server112 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in radareorg/radare2.

How many CVEs have a located fix in radareorg/radare2?: 101 published CVEs have a fix traced to functions in radareorg/radare2, touching 228 functions across 89 files.
Which function in radareorg/radare2 has been patched by the most CVEs?: r_bin_ne_get_relocs in libr/bin/format/ne/ne.c has been changed by 4 CVE fixes, from 2022 to 2026.
How large is a typical CVE fix in radareorg/radare2?: The median fix changes 12 lines. 65% of fixes change 20 lines or fewer, and 46% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track radareorg/radare2 CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing