Security readout for executives and security teams
Plain-English summary
Radare2 has a memory safety flaw in its Python bytecode parser. A crafted input could trigger use of freed memory, potentially crashing analysis workflows and exposing memory contents. The public record identifies a specific 5.3.0-git snapshot and a fixing commit, but does not show confirmed active exploitation.
Executive priority
Treat as urgent for teams using radare2 in automated or exposed analysis workflows. For isolated researcher workstations, prioritize normal patching plus sandboxing. No source provided confirms active exploitation.
Technical view
CVE-2021-32495 is a CWE-416 use-after-free in radare2's pyc parser function get_none_object. The CVE says attackers can read freed memory and cause denial of service. CVSS 3.1 is 10.0, but affected-version detail is limited to radare2 5.3.0-git 26142.
Likely exposure
Exposure is most likely in systems or analyst workstations using the affected radare2 git build to process untrusted Python bytecode. Automated malware-analysis, file-triage, or reverse-engineering pipelines have higher operational risk if they accept attacker-controlled samples.
Exploitation context
The source bundle does not cite KEV listing or confirmed in-the-wild exploitation. The risk comes from attacker-supplied files reaching a vulnerable parser. Public references include an issue and commit, but no exploit status is established here.
Researcher notes
The CVE record is sparse and internally broad: CVSS indicates maximum network impact, while the description names memory read and denial of service. Do not assume affected releases beyond the listed git snapshot without vendor confirmation.
Mitigation direction
- Check vendor guidance and update radare2 to a version containing commit 5e16e2d1c9fe245e4c17005d779fde91ec0b9c05.
- Avoid processing untrusted pyc files with affected radare2 builds until remediated.
- Run radare2 analysis jobs with sandboxing and least privilege.
- Restrict automated file-analysis services from exposing radare2 directly to untrusted network input.
Validation and detection
- Inventory radare2 installations and identify any 5.3.0-git 26142 builds.
- Verify source or package history includes the referenced fixing commit.
- Review analysis pipelines for untrusted pyc input paths.
- Confirm crashes or parser errors are monitored in radare2-backed workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32495 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.