CVE-2021-32495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32495
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32495.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32495
Downstream
Published
2023-07-07T19:15:09Z
Modified
2026-08-07T19:46:37Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.

References

Affected packages

Git / github.com/radareorg/radare2

Affected ranges

Type
GIT
Repo
https://github.com/radareorg/radare2
Events
Introduced
ee753c25094c6e1c62dfb9596423824251dbc943
Last Affected
ee753c25094c6e1c62dfb9596423824251dbc943
Fixed
5e16e2d1c9fe245e4c17005d779fde91ec0b9c05
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:radare:radare2:5.3.0:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "5.3.0"
        },
        {
            "last_affected":  "5.3.0"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32495.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "281144442903635776283408469084151380870",
            "length":  228
        },
        "id":  "CVE-2021-32495-89e7b878",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05",
        "target":  {
            "file":  "libr/bin/format/pyc/marshal.c",
            "function":  "get_none_object"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "293727422535202617895383407783017198569",
                "325426534639164205903082921648749687711",
                "228831602891691957477592427643617201977",
                "224186186095923557659101101390381017579",
                "212850913520644578786064218748185165524",
                "172004653938665698361432276404790548809",
                "26425263749308728204585716171309190508",
                "149829655951370627201221230733046478701",
                "246419025862705036512837914482105705955",
                "228127056506232150828101904703011610912"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-32495-e60a11fd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05",
        "target":  {
            "file":  "libr/bin/format/pyc/marshal.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "152887779541464158850990740854948468430",
            "length":  2432
        },
        "id":  "CVE-2021-32495-f6dc3e9a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05",
        "target":  {
            "file":  "libr/bin/format/pyc/marshal.c",
            "function":  "get_object"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T19:46:37Z"