Security readout for executives and security teams
Plain-English summary
CVE-2018-11380 is a crash bug in radare2 2.5.0. A specially crafted Mach-O file can make the application read beyond heap memory bounds and crash. The likely business impact is disruption to reverse-engineering, malware-analysis, or file-inspection workflows that process untrusted Mach-O samples.
Executive priority
Treat this as a targeted operational reliability issue, not an enterprise-wide emergency. Prioritize teams that analyze untrusted binaries or malware samples, because crashes can interrupt investigations or automated triage.
Technical view
The issue is reported in parse_import_ptr() in radare2 2.5.0. Crafted Mach-O input can trigger a heap-based out-of-bounds read leading to application denial of service. The source bundle provides an upstream issue and commit reference, but no CVSS score, CWE, KEV listing, or named fixed release.
Likely exposure
Exposure is most likely where radare2 2.5.0 parses Mach-O files from untrusted or semi-trusted sources, including malware labs, triage pipelines, and analyst workstations.
Exploitation context
The sources describe denial of service through a crafted Mach-O file. KEV is false, and the bundle provides no evidence of active exploitation, public weaponization, privilege escalation, or code execution.
Researcher notes
Evidence is limited to the CVE description, upstream issue, and commit reference. The bundle does not provide CVSS, CWE mapping, detailed affected ranges beyond radare2 2.5.0, or a named fixed release.
Mitigation direction
- Identify systems or workflows using radare2 2.5.0.
- Check upstream radare2 guidance, issue 9970, and the referenced commit.
- Upgrade or rebuild only after confirming the vendor-supported fixed version.
- Avoid parsing untrusted Mach-O files with affected radare2 builds.
- Run file-analysis tooling in isolated, recoverable environments.
Validation and detection
- Inventory radare2 versions in analyst workstations and automation.
- Confirm whether builds include upstream commit 60208765887f5f008b3b9a883f3addc8bdb9c134.
- Review pipelines for automated Mach-O parsing with radare2.
- Check crash telemetry around Mach-O analysis jobs.
- Document compensating controls for untrusted sample handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-11380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/radare/radare2/commit/60208765887f5f008b3b9a883f3addc8bdb9c134CVE reference · x_refsource_MISC
- https://github.com/radare/radare2/issues/9970CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.