CVE-2026-45324: Rizin Use-After-Free Vulnerability

CVE-2026-45324 Overview

CVE-2026-45324 is a double free vulnerability in Rizin, a UNIX-like reverse engineering framework and command-line toolset. The flaw resides in the byte_pattern_search() function within librz/core/cmd/cmd_search.c and stems from incorrect pointer ownership semantics. Triggering the issue can lead to memory corruption with limited integrity and availability impact. The vulnerability is tracked under CWE-415: Double Free and is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.

Critical Impact
Successful exploitation can corrupt heap memory inside the Rizin process, leading to crashes or potential further memory corruption when analyzing crafted input.

Affected Products

Rizin reverse engineering framework (versions prior to the fix commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe)
Command-line tools shipped with Rizin that invoke the search subsystem
Downstream distributions and packages bundling vulnerable Rizin builds

Discovery Timeline

2026-05-29 - CVE-2026-45324 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-45324

Vulnerability Analysis

The vulnerability is a double free condition inside the byte-pattern search routine of Rizin's command subsystem. The byte_pattern_search() function in librz/core/cmd/cmd_search.c declares incorrect ownership over a heap pointer. As a result, the same allocation can be released twice during the search command lifecycle. Double free conditions corrupt the heap allocator's internal metadata. This can crash the process, produce inconsistent program state, or in some allocators be leveraged toward more advanced memory corruption primitives. The flaw is classified under CWE-415 and is exploitable only under constrained conditions involving local interaction with the tool.

Root Cause

The root cause is incorrect pointer ownership in byte_pattern_search(). The function frees a buffer it does not exclusively own, while another code path along the same execution flow also releases the same pointer. Without a clear ownership contract or a nulling assignment after the first free, the second free operates on a stale pointer that still references the originally allocated chunk.

Attack Vector

Exploitation requires physical access with high attack complexity, low privileges, and user interaction. An attacker must persuade a local user to run Rizin against attacker-influenced input that triggers the vulnerable search path. The scope is changed because corruption can affect components beyond the immediate execution context. Confidentiality is not affected, while integrity and availability impacts are low.

No verified exploit code is available. Technical details on the fix are documented in the Rizin GitHub Security Advisory GHSA-2377-chx7-xf7c and the upstream patch commit.

Detection Methods for CVE-2026-45324

Indicators of Compromise

Unexpected crashes of rizin or rz-* binaries during search-related commands, particularly those invoking byte-pattern matching.
Glibc heap diagnostics such as double free or corruption messages emitted by the affected process.
Core dumps from Rizin processes with stack frames referencing byte_pattern_search in cmd_search.c.

Detection Strategies

Inventory installed Rizin versions across analyst workstations and compare against the fixed commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe.
Run Rizin builds under AddressSanitizer (ASan) in test environments to surface double free events on suspicious inputs.
Monitor package management logs for installations of Rizin versions predating the security advisory.

Monitoring Recommendations

Forward process crash telemetry and coredumpctl events from analyst endpoints to a centralized logging platform.
Alert on repeated abnormal terminations of reverse-engineering tooling executed by the same user session.
Track invocations of Rizin against untrusted binaries pulled from external sources or shared malware repositories.

How to Mitigate CVE-2026-45324

Immediate Actions Required

Upgrade Rizin to a build that includes commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe or later.
Rebuild and redeploy any internal tooling or container images that bundle the Rizin library librz.
Restrict execution of Rizin to trusted samples until patched versions are deployed across analyst hosts.

Patch Information

The vulnerability is fixed upstream by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe, which corrects pointer ownership inside byte_pattern_search() in librz/core/cmd/cmd_search.c. Refer to the Rizin patch commit and the GHSA-2377-chx7-xf7c advisory for full remediation details. Distribution maintainers should backport the fix into supported package versions.

Workarounds

Avoid executing byte-pattern search commands in Rizin against untrusted or attacker-controlled binaries until patched.
Run Rizin inside isolated sandboxes or ephemeral virtual machines to contain the impact of process corruption.
Limit local user accounts permitted to run reverse-engineering tooling to reduce exposure to the vulnerable code path.

bash

# Build Rizin from source with the fix applied
git clone https://github.com/rizinorg/rizin.git
cd rizin
git checkout 045fff363b42b8a6dda8ad5229c29ec3267e7dbe
meson setup build
ninja -C build
sudo ninja -C build install