Rizinorg vulnerabilities
Published CVEs affecting Rizinorg products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-45612
Medium · 5.5
CWE-125 Jul 16, 2026
rz-libdemangle: Out of bound read in rust demangler
rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the demangler structure is not yet initialized. This issue is fixed in commit 6bf56d3.
CVE-2026-45613
Low · 3.3
CWE-125 May 29, 2026
Rizin: Heap-buffer-overflow in OMF parser
Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a heap-buffer-overflow in librz/bin/format/omf/omf.c. This vulnerability is fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.
CVE-2026-45324
Low · 3.3
CWE-415 May 29, 2026
Rizin: Double free in cmd_search.c
Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.
CVE-2026-22780
Medium · 6.1
CWE-770 Feb 2, 2026
Rizin has a heap overflow on mach0_chained_fixups.c
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2.