CVE-2026-8696 is a high severity (CVSS 7.5) memory bug in radare2 6.1.5. The GDB remote client can free the same memory twice if the server sends malformed thread information. That can crash the tool and may allow code execution. The upstream project has committed a fix, so update to a build that contains it.
What's affected
The record names radare2 6.1.5. The issue is in the function that lists processes in the GDB remote client code. The upstream commit that fixes it is linked below, and the project issue was closed after the commit.
I could not confirm a numbered release that contains the fix, so check the radare2 release notes or build from a commit at or after the fix. The risk only applies when radare2 connects to a GDB server, for example with a gdb URL, and that server returns bad replies.
How to check if you're exposed
r2 -v
This prints the version and build commit. Compare the commit with the fix commit in the sources. Package managers and distributions may carry radare2 under their own version numbers, so ask your distribution whether it has backported the fix.
Then think about use. If analysts attach radare2 to remote GDB stubs on devices or emulators you do not control, that is the exposed workflow.
What to do now
- Update radare2 to a release or commit that includes the upstream fix.
- Until then, avoid connecting radare2 to GDB servers you do not trust.
- Run reverse engineering tools in a disposable virtual machine or container.
- Ask your package source whether the fix has been backported to the version you install.
Why it matters
The weakness is CWE-416 (use after free). The issue report describes the pattern: after a list entry is appended to a list, the local pointer is not cleared, so an error path frees the last entry a second time when it cleans up the list. The fix clears the pointer and frees the inner buffer correctly.
Security tools are software too, and they often parse hostile input by design. Analysts who connect a debugger to an untrusted target are trusting that target's replies. Isolation is the practical defence.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Is there a patched release number?
I could not confirm one. Use a build that includes the upstream fix commit and check the project release notes.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
- https://github.com/radareorg/radare2/commit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c
- https://github.com/radareorg/radare2/issues/25836
- https://www.vulncheck.com/advisories/radare2-use-after-free-via-gdbr-pids-list
Last reviewed: 19 October 2026.
