PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6197 Radare CVE debrief

CVE-2017-6197 is a denial-of-service issue in radare2 1.2.1. When r_read_* helpers in libr/include/r_endian.h process a crafted binary file, they can dereference a NULL pointer and crash the application. NVD classifies the weakness as CWE-476 and rates the issue as medium severity.

Vendor
Radare
Product
Radare2
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Teams running radare2 1.2.1 in tooling, automation, or file-analysis workflows should care most, especially where attacker-controlled or untrusted binaries are parsed.

Technical summary

The vulnerable code path is in the r_read_* routines, including r_read_le32, inside r_endian.h. According to the NVD record, the flaw is a NULL pointer dereference that results in an application crash when parsing a crafted binary file. The NVD entry assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and CWE-476.

Defensive priority

Medium priority. Upgrade or patch radare2 if version 1.2.1 is deployed in any workflow that handles untrusted files, because a malformed input can trigger a crash and interrupt analysis or service availability.

Recommended defensive actions

  • Upgrade radare2 to a fixed version that includes the referenced patch.
  • If immediate upgrading is not possible, restrict which binaries are parsed and avoid feeding untrusted files into radare2 1.2.1.
  • Apply the upstream fix referenced in the linked radare2 commit if you maintain a downstream build.
  • Monitor file-processing jobs and services for crashes related to malformed inputs.
  • Validate any automation that invokes radare2 on user-supplied content and add input handling controls where possible.

Evidence notes

The CVE record and NVD entry both describe a crash caused by a NULL pointer dereference in radare2 1.2.1 when parsing crafted binaries. NVD lists CWE-476 and the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The linked radare2 commit and issue provide patch/advisory context.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-6197 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-6197

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-6197 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-6197

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.