CVE-2019-19647

PoC —

CVSS 3.1

7.8 high

EPSS

2%p74

Published

Dec 9, 2019 (Dec 9, 2019)

Modified

Jun 17, 2026

Description

radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.

Vendors: radare fedoraproject
Products: radare2, fedora
Weakness: CWE-476
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.