Security readout for executives and security teams
Plain-English summary
CVE-2018-10187 is a denial-of-service issue in radare2 2.5.0. A specially crafted Android DEX file can make the tool read beyond a heap buffer while analyzing Dalvik bytecode, potentially crashing analysis workflows.
Executive priority
Treat this as a targeted availability risk to reverse-engineering and Android analysis operations, not a confirmed broad enterprise compromise risk. Prioritize if radare2 is used on untrusted mobile files.
Technical view
The source describes a heap-based buffer over-read in radare2's dalvik_op function in libr/anal/p/anal_dalvik.c. The impact stated is denial of service when a crafted DEX file is processed. It is explicitly distinct from CVE-2018-8809.
Likely exposure
Exposure is most likely in security research, malware analysis, reverse-engineering, or CI workflows that use radare2 2.5.0 to inspect Android DEX files, especially files supplied by external parties.
Exploitation context
The provided sources do not cite active exploitation, and the CVE is not marked KEV. The described attack condition is processing a crafted DEX file with the vulnerable radare2 version.
Researcher notes
Evidence is sparse: the CVE description names radare2 2.5.0, dalvik_op, heap over-read, crafted DEX, and DoS impact. No CVSS, CWE, patch version, or exploitation evidence is provided in the source bundle.
Mitigation direction
- Identify systems or pipelines using radare2 2.5.0.
- Check radare2 project guidance for fixed versions or recommended updates.
- Avoid processing untrusted DEX files with vulnerable radare2 builds.
- Run Android file analysis tooling in isolated, disposable environments.
- Add crash monitoring for automated DEX analysis workflows.
Validation and detection
- Confirm the radare2 version used on analyst workstations and build systems.
- Review whether workflows process Android DEX files from untrusted sources.
- Compare installed builds against radare2 advisory or issue guidance.
- Check analysis logs for crashes during DEX parsing.
- Document residual exposure if vulnerable tooling cannot be upgraded.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10187 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/radare/radare2/issues/9913CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.