CVE-2025-60361: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability was discovered in radare2 versions 5.9.8 and earlier, specifically in the function bochs_open. The vulnerability was assigned CVE-2025-60361 and was publicly disclosed on October 17, 2025. The issue affects the radare2 software, which is a reverse engineering framework (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low severity) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The issue requires local access, low attack complexity, and low privileges to exploit (NVD, Ubuntu).

The primary impact of this vulnerability is on system availability through memory resource exhaustion, potentially leading to denial of service conditions. The CVSS scoring indicates no impact on confidentiality or integrity, with only availability being affected at a low level (Ubuntu, GitHub PR).

The vulnerability has been fixed in version 6.0.0 of radare2. Users are advised to upgrade to the fixed version. The fix was implemented through a pull request (#24312) which addresses the memory leak in the bochs_open function (GitHub PR, Debian Tracker).