CVE-2026-45613: Rizin Buffer Overflow Vulnerability

CVE-2026-45613 Overview

CVE-2026-45613 is a heap-buffer-overflow vulnerability in Rizin, a UNIX-like reverse engineering framework and command-line toolset. The flaw resides in librz/bin/format/omf/omf.c, the parser responsible for handling Object Module Format (OMF) binary files. An attacker can trigger the out-of-bounds read by convincing a user to open a crafted OMF file in Rizin. The issue is classified under [CWE-125] (Out-of-bounds Read) and is fixed by commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.

Critical Impact
Processing a malicious OMF file in Rizin results in a heap out-of-bounds read, exposing process memory contents or causing the application to crash.

Affected Products

Rizin reverse engineering framework (versions prior to commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47)
OMF binary parser component (librz/bin/format/omf/omf.c)
Downstream tools and integrations that link against Rizin's librz libraries

Discovery Timeline

2026-05-29 - CVE CVE-2026-45613 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-45613

Vulnerability Analysis

The vulnerability is a heap-based out-of-bounds read inside Rizin's OMF binary loader. OMF is a legacy object module format historically used by Intel and Microsoft toolchains. When Rizin parses an OMF object, routines in librz/bin/format/omf/omf.c walk record structures whose lengths are taken from attacker-controlled fields in the file. Insufficient validation of these length and offset values allows reads past the bounds of heap-allocated buffers.

Exploitation requires local file access and user interaction, since a victim must load the crafted binary into Rizin or a tool built on top of librz. The vulnerability does not yield code execution on its own. The realistic impact is information disclosure of adjacent heap memory and denial of service through process crashes triggered by invalid memory access.

Root Cause

The parser trusts size and offset fields embedded in the OMF record headers without verifying them against the actual size of the mapped buffer. When a record claims a length that extends past the end of the allocated region, subsequent byte reads dereference memory outside the intended bounds. This is a classic missing bounds check on externally supplied data.

Attack Vector

An attacker crafts a malformed OMF file containing manipulated record sizes or offsets. The file is delivered to a target via email, malware analysis sample sharing, or a public sample repository. When the analyst opens the file in Rizin or any tool that invokes the OMF loader through librz, the parser reads beyond the heap buffer and either leaks memory contents into accessible structures or crashes the process.

No proof-of-concept code is published for this issue. Technical context is available in the Rizin Security Advisory GHSA-wprr-wrcw-mw6v and the upstream fix commit.

Detection Methods for CVE-2026-45613

Indicators of Compromise

Unexpected crashes or segmentation faults in rizin, rz-bin, or other librz-linked binaries during file analysis sessions.
Core dumps referencing functions inside librz/bin/format/omf/omf.c such as OMF record-parsing routines.
OMF files with inconsistent record length fields that exceed the on-disk file size.

Detection Strategies

Run sample triage workflows under AddressSanitizer (ASan) builds of Rizin to surface heap out-of-bounds reads during automated analysis.
Inventory analyst workstations and CI pipelines to identify Rizin versions predating commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47.
Monitor process telemetry for repeated Rizin crashes that correlate with the opening of untrusted binary samples.

Monitoring Recommendations

Log invocations of rizin, rz-bin, rz-asm, and related CLI tools on analyst endpoints, including the file paths passed as arguments.
Alert on Rizin processes generating core dumps or terminating with SIGSEGV when handling files from external sources.
Track package versions of Rizin across Linux distributions, container images, and macOS package managers to confirm patched builds are deployed.

How to Mitigate CVE-2026-45613

Immediate Actions Required

Upgrade Rizin to a release containing commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47 or build from current main.
Quarantine analyst workstations that routinely process untrusted OMF samples until patched binaries are deployed.
Restrict opening of unknown OMF object files until the underlying librz library is updated.

Patch Information

The maintainers fixed the heap-buffer-overflow in commit e6d0937c8a083e23ed76ccfb9f631cdc50c7af47 to the rizinorg/rizin repository. The fix adds bounds validation on OMF record parsing inside librz/bin/format/omf/omf.c. Review the GitHub commit and rebuild downstream packages that statically link librz.

Workarounds

Avoid loading OMF (.obj) files from untrusted sources into Rizin until the patch is applied.
Execute Rizin inside a sandboxed virtual machine or container without access to sensitive data when analyzing unknown binaries.
Disable or remove OMF parsing functionality in custom builds where the format is not required for analysis workflows.

bash

# Build patched Rizin from source
git clone https://github.com/rizinorg/rizin.git
cd rizin
git checkout e6d0937c8a083e23ed76ccfb9f631cdc50c7af47
meson setup build
ninja -C build
sudo ninja -C build install