LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19590: In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_...

In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2019-19590 affects radare2 through version 4.0. A crafted input can trigger a memory corruption flaw that may crash the application and, according to the CVE description, may possibly allow code execution. Business urgency depends on whether radare2 processes untrusted files or inputs in your environment.

Executive priority

Treat as priority for security research, malware analysis, reverse engineering, and automation systems that ingest untrusted files. It is less urgent where radare2 is absent or only used manually on trusted input.

Technical view

The issue is an integer overflow in new_token_size inside r_asm_massemble in libr/asm/asm.c. The overflow can lead to use-after-free of the tokens buffer, which may be refilled with attacker-controlled data. Sources describe denial of service and possible arbitrary code execution via crafted input.

Likely exposure

Exposure is most likely where radare2 through 4.0 is installed and used to analyze or assemble untrusted binaries, samples, or user-supplied input. The bundle does not identify affected CPEs or downstream package versions beyond Fedora advisories.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Public description supports attacker-supplied crafted input causing application crash or possible code execution, but does not provide confirmed exploitation details.

Researcher notes

Evidence is limited to the CVE description, upstream issue reference, and Fedora advisories. No CVSS, CWE, precise fixed version, or KEV exploitation evidence is provided in the bundle, so validation should focus on version inventory and vendor advisory confirmation.

Mitigation direction

  • Inventory radare2 installations and versions across workstations, CI, and analysis systems.
  • Prioritize systems processing untrusted files or user-supplied analysis input.
  • Apply upstream or distribution vendor updates that address CVE-2019-19590.
  • Use sandboxing or isolation for radare2 analysis workflows handling untrusted input.
  • Check Fedora advisories if using Fedora-packaged radare2.

Validation and detection

  • Confirm whether installed radare2 versions are through 4.0.
  • Review package changelogs or vendor advisories for CVE-2019-19590 coverage.
  • Identify workflows invoking radare2 on untrusted or externally supplied files.
  • Verify updated systems still pass expected analysis workflow tests.
  • Document any systems where updates are unavailable and compensating controls apply.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-19590 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.