PatchTheCVECVE-2026-8696: radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client c
CVE-2026-8696 is a high-severity flaw (CVSS 7.5) affecting radare2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the e
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | No |
| Weakness | CWE-416 |
| Published | 2026-05-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-8696?
radare2: upgrade to newer than 6.1.4. Exact commands for each OS are on this page.
Is CVE-2026-8696 being exploited?
CVE-2026-8696 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-8696 affect?
CVE-2026-8696 affects radare2. Severity is high (CVSS 7.5). radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread in
How urgent is CVE-2026-8696?
Priority 48/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-40527 HIGH 7.8 UPGRADE radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path wher
- CVE-2026-40499 HIGH 7.8 UPGRADE radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() fu
- CVE-2026-40517 HIGH 7.8 UPGRADE radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function t
- CVE-2026-6940 HIGH 7.1 UPGRADE radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers
- CVE-2026-6941 MEDIUM 6.6 UPGRADE radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attac