CVE-2026-112077 radareorg CVE debrief

Who should care

Defenders responsible for radareorg radare2 installations, particularly those using versions 6.2.0 or 6.2.2, should assess exposure and prioritize upgrading to version 6.2.4 or applying the patch 18fd12efa98a7d1977de7bdd379d8a848777b90f.

Why it matters

Defenders should prioritize upgrading to version 6.2.4 or applying the patch 18fd12efa98a7d1977de7bdd379d8a848777b90f to address the vulnerability in radareorg radare2, as remote exploitation is possible but has high complexity and is difficult to exploit.

• Remote exploitation is possible but requires high complexity and is difficult to exploit
• Protection mechanism failure can occur due to manipulation of the HTTP Sandbox Policy Handler
• Upgrading to version 6.2.4 or applying the patch can address the vulnerability

Technical summary

The vulnerability affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler in radareorg radare2 6.2.0/6.2.2. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible but has high complexity and is assessed as difficult. The attack can occur when the HTTP server is started and exposed to an attacker. Upgrading to version 6.2.4 or applying the patch 18fd12efa98a7d1977de7bdd379d8a848777b90f can address the vulnerability. Defenders should prioritize upgrading or applying the patch and review the HTTP sandbox configuration.

Defensive priority

Defenders should prioritize upgrading to version 6.2.4 or applying the patch 18fd12efa98a7d1977de7bdd379d8a848777b90f to address the vulnerability in radareorg radare2.

Recommended defensive actions

• Upgrade to version 6.2.4 or apply the patch 18fd12efa98a7d1977de7bdd379d8a848777b90f
• Review and adjust the HTTP sandbox configuration to prevent unintended exposure
• Monitor for potential exploitation attempts
• Perform a thorough review of the affected component's configuration and ensure that it is properly secured
• Verify that the patch has been successfully applied and that the vulnerability has been remediated
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was detected in radareorg radare2 6.2.0/6.2.2 and affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Evidence is based on source-provided information and CVE metadata. Defenders should verify affected product deployments and assess exposure. The HTTP server defaults to http.sandbox=true, but cfg.sandbox.grain defaults to all, allowing all sandbox capabilities, including exec. Therefore, enabling the HTTP sandbox alone does not prevent command

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.