CVE-2022-28072: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability was identified in the r_read_le32 function affecting radare2 versions 5.4.2 and 5.4.0. The vulnerability was assigned CVE-2022-28072 and was disclosed on August 22, 2023 (NVD).

The vulnerability is classified as a heap buffer overflow (CWE-787: Out-of-bounds Write) in the r_read_le32 function. The National Vulnerability Database has assigned it a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can significantly impact system availability (NVD).

The vulnerability primarily affects system availability, as indicated by the CVSS metrics. When successfully exploited, it can lead to a heap buffer overflow condition which could potentially cause system crashes or service disruptions (NVD).

The vulnerability has been fixed in subsequent versions of radare2. Users should upgrade to a version newer than 5.4.2. The fix was implemented through a commit addressing the out-of-bounds read crash in RAnal.hexagon (GitHub Commit).