CVE-2026-45324

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45324
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45324.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45324
Aliases
  • GHSA-2377-chx7-xf7c
Published
2026-05-29T19:08:39.051Z
Modified
2026-07-15T17:32:58.780466Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L CVSS Calculator
Summary
Rizin: Double free in cmd_search.c
Details

Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmdsearch.c:bytepattern_search() due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.

Database specific 
{
    "cwe_ids": [
        "CWE-415"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45324.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "045fff363b42b8a6dda8ad5229c29ec3267e7dbe"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/rizinorg/rizin

Affected ranges

Type
GIT
Repo
https://github.com/rizinorg/rizin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
045fff363b42b8a6dda8ad5229c29ec3267e7dbe
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v0.*
v0.7.0
v0.7.1

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "73286429900527217269097830958904372987",
                "129613054394644230008499144015011426963",
                "310437377872128381368964749687160766197",
                "334393782076472657522748277344020770151",
                "16875367856771416183706520168536853947"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-45324-14eff9ff",
        "target": {
            "file": "librz/main/rizin.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "168653326637470442785310017839146885198",
            "length": 516.0
        },
        "deprecated": false,
        "id": "CVE-2026-45324-1a765121",
        "target": {
            "function": "cb_search_in",
            "file": "librz/core/cconfig.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "173751125623755594680094144826040262490",
            "length": 823.0
        },
        "deprecated": false,
        "id": "CVE-2026-45324-5b7b1548",
        "target": {
            "function": "byte_pattern_search",
            "file": "librz/core/cmd/cmd_search.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "112036908006964024873924886329071468148",
            "length": 775.0
        },
        "deprecated": false,
        "id": "CVE-2026-45324-b2d6a01f",
        "target": {
            "function": "__core_cmd_search_asm_infinite",
            "file": "librz/core/cmd/cmd_search.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "74350750776434614436549053436921847995",
                "273369279489211954361041388717388955581",
                "261920567875112357487326509554220769426",
                "164347555907919192719562378523316231501",
                "193933090926494447361333707884722294269"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-45324-c30e452f",
        "target": {
            "file": "librz/core/cconfig.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "324467158115311576587415140426701187049",
                "255853838124915349939897343591761556252",
                "38751623303877825183698156380829365320",
                "51466747426583892849508956450757617548",
                "199376235564984307467039448793176516900",
                "21519694026736453784617669128530899858",
                "5314392496571126064311778756809100288",
                "195507825736233633992862795036487467850",
                "29491928847038398014314480568767758040",
                "201477541207789104180665777758662008503",
                "102738364067239721140128237934796728545",
                "213909470814965123432991268833312073077",
                "233270653989836765148222706534884002039",
                "224787875578157571128219044163423305948",
                "249906488398784168167214282874240092340",
                "225179368773601224210782865547008336406",
                "297359510665080983929198585472131689718",
                "97865676954578311172042801677420983059",
                "334221695990102430544434217317628698171"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-45324-c4381f34",
        "target": {
            "file": "librz/core/cmd/cmd_search.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "274165338488460052375351024664007638841",
                "239808650375368941679244641385535929462",
                "54208535138146834734838105247074905513",
                "171283501962377469168151204640632117170",
                "301106467749887075084150550885848241007",
                "265513417584622012381780089929793072711",
                "47891183488526598918474118867528673755",
                "15404511438512694357541134963866445933",
                "152405550502006910466388175341137318985",
                "284245113158847983885026364291750230423",
                "108616406068950806547816472758298289194",
                "276146142285132009963951309076454784203",
                "224813970319487189702894603535076390956",
                "91970698437425777497984935144556837831",
                "291749455069773004898996274332522122502",
                "101244467215145021231664589998864114442",
                "194896598411412728882962744360911274595",
                "278946909468911547095446289842476515990",
                "158460233441781063380118978299309363086",
                "39051792047504746446951453103458313836",
                "331295303516718743932529078076912855894",
                "131658652011553936564739379744683028970",
                "183068133943636981693017670958522064874",
                "274477609874376993416354877685919765765",
                "245493353910064329931123527504836597520",
                "258444014314222219475500467516171417452",
                "25679597564396090773772443786622038676",
                "276377007925783204023604308733456366842",
                "281502776446696559084972053640865257640",
                "304116587738495730970425727505462909428",
                "236396052143153342514320396602864773177",
                "19708109481847922878455889053197413461",
                "336728033915517370799702194044628904180",
                "257304197503087327268417999526824236981",
                "189662989700862759921607798963481546148",
                "296436153338108916000408468852658369186",
                "293893334031483810550409948526900614063",
                "57600973497007543333327144997847607066",
                "64346377890599389465978850483394188120",
                "212100392449146545438863877850861862444",
                "256926280704881008967313052379364232662",
                "317385271730902783082173440502294226968",
                "67714505473328110139991674538462894044",
                "189258628491971918408213474723525457202",
                "181306044857553476943580056084384481362",
                "171230772156457700305371131750958434543",
                "11373186996622432471110956156395602848",
                "96206143250174038149744677647862211882",
                "78923894597432702273768468579940071",
                "188479462516994061890780139157984674972",
                "69892987661938626654207592593809146066",
                "31562165530036425133769219945643339878",
                "338408849997163942230838331108007657307",
                "130634599821983115948850399963482055311",
                "49066945766306381173196382976672771383",
                "65793705898616264304066119012528970492",
                "3222754063603497026324575012743028062",
                "249184670006725602758810926152726176071",
                "74715015525837120414287833738367431045",
                "4993762009940667128229117883386648519",
                "192553014232571022793160497040369546453",
                "64393411644474338025949921498301894594"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-45324-cceb4300",
        "target": {
            "file": "librz/core/cbounds.c"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "179107070867558336413727845783560910327",
                "290535925943460871247496964182329772055",
                "128249297306917082098479606629862937809",
                "189605053814995787855467909970390648098"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-45324-cf82b87d",
        "target": {
            "file": "librz/include/rz_core.h"
        }
    },
    {
        "source": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "15753661490823951028364967426782730702",
            "length": 25697.0
        },
        "deprecated": false,
        "id": "CVE-2026-45324-d59c07c8",
        "target": {
            "function": "rz_main_rizin",
            "file": "librz/main/rizin.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T17:32:58Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45324.json"