CVE-2017-9949: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a deni...

Security readout for executives and security teams

This issue affects radare2 1.5.0 when it analyzes a maliciously crafted binary file. The documented outcome is an application crash from a stack-based buffer underflow, with unspecified other impact left unresolved in the public record. There is no KEV listing or provided evidence of active exploitation. Exposure is most likely where radare2 1.5.0 processes untrusted binaries, samples, firmware, or filesystem images. Internet-facing exposure is not established by the sources; the practical risk centers on analyst workstations, automated triage systems, and malware-analysis pipelines. Prioritize remediation where radare2 is used in automated or high-volume analysis of untrusted files. This is not evidenced as actively exploited, but it can disrupt security operations and may create uncertain additional risk on exposed analysis systems. Mitigation focus: Identify and retire radare2 1.5.0 from analysis workflows.; Upgrade to a radare2 release that includes the referenced upstream fix.; Check radare2 vendor guidance for the fixed release boundary..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.