CVE Feed

    Dashboard / CVE / CVE-2018-10187

    CVE-2018-10187

    In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. Note that this issue is different from CVE-2018-8809, which was patched earlier.

    Published:Apr 17, 2018
    Last Modified:Nov 21, 2024
    EPS:Apr 17, 2018
    EPSS Score:0.00226
    CVSS Score:5.5

    Affected Products

    Vendor
    Radare
    Product
    Radare2

    Exploits

    https://github.com/radare/radare2/issues/9913https://github.com/radare/radare2/issues/9913

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-14760 (CVSS 1.9) — A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bit…
    CVE-2026-14758 (CVSS 1.9) — A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_a…
    CVE-2026-14757 (CVSS 1.9) — A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of …
    CVE-2026-8696 (CVSS 8.7) — radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client c…
    CVE-2026-8695 (CVSS 8.7) — radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote a…
    CVE-2026-6942 (CVSS 9.3) — radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attack…
    CVE-2026-6941 (CVSS 6.9) — radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attac…
    CVE-2026-6940 (CVSS 6.9) — radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers…
    CVE-2026-40517 (CVSS 8.4) — radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function t…
    CVE-2026-40527 (CVSS 8.5) — radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path wher…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High