« Volver al listado

CVE-2026-45324

Estado: AplazadaBaja (3.3)—

Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Rizin — RizinAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45324",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45324",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-29T19:47:55.664672Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "PHYSICAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 0.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rizinorg",
          "product": "rizin",
          "versions": [
            {
              "status": "affected",
              "version": "< 045fff363b42b8a6dda8ad5229c29ec3267e7dbe"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T20:16:25.977",
  "references": [
    {
      "url": "https://github.com/rizinorg/rizin/commit/045fff363b42b8a6dda8ad5229c29ec3267e7dbe",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-2377-chx7-xf7c",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe."
    },
    {
      "lang": "es",
      "value": "Rizin es un framework de ingeniería inversa similar a UNIX y un conjunto de herramientas de línea de comandos. Hay un 'double free' en librz/core/cmd/cmd_search.c:byte_pattern_search() debido a una declaración incorrecta de la propiedad del puntero. Esta vulnerabilidad se corrige mediante el commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe."
    }
  ],
  "lastModified": "2026-07-22T06:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}