CVE-2025-63745: 
NixOS vulnerability analysis and mitigation

CVE-2025-63745 is a NULL pointer dereference vulnerability (CWE-476) in radare2's NE binary parser that causes a denial of service via segmentation fault. It affects radare2 version 6.0.5 and earlier (specifically commit 0984df0b5d5d4b8f4b66251a6c762f5d69acb088), within the info() function of libr/bin/p/bin_ne.c. The vulnerability was discovered by Vlatko Kosturjak of Marlink Cyber, reported on 2025-10-07, published on 2025-10-08, and patched the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (Marlink Advisory, Feedly).

The root cause (CWE-476) is a missing null check in the info() function of bin_ne.c before passing the ne->os pointer to strdup() and subsequently strlen(). When radare2 parses a malformed NE (New Executable) binary where the ne_header field is NULL — due to a failed or incomplete header read — the code proceeds to dereference the null pointer at line 83, triggering a SIGSEGV. The fix, applied in commit 6c5df3f8570d4f0c, adds null checks for ne->ne_header across multiple NE parser functions (r_bin_ne_get_segments, r_bin_ne_get_symbols, r_bin_ne_get_imports, r_bin_ne_get_entrypoints, r_bin_ne_get_relocs) and substitutes a safe default ("os2") when ne->os is null (Marlink Advisory, Patch Commit, GitHub Issue). Exploitation requires a user or automated pipeline to open a specially crafted NE binary file with radare2.

Successful exploitation results in a denial of service — radare2 crashes with a segmentation fault (SIGSEGV) when processing the malformed input. There is no impact on confidentiality or integrity; only availability is affected. The primary risk is to automated binary analysis pipelines or CI/CD environments that use radare2 to process untrusted binaries, where a crafted file could repeatedly crash the analysis tool (Marlink Advisory).

No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. A proof-of-concept crash file (crash_002.bin) was included in the original bug report, making reproduction straightforward, but the local attack vector and requirement for user interaction significantly limit the threat surface (GitHub Issue, Feedly).

1. Craft malformed NE binary: Create or obtain a malformed NE (New Executable) binary file where the NE header is absent or unreadable, causing ne_header to be NULL after parsing. The original reporter provided a sample (crash_002.bin) attached to GitHub Issue #24660.
2. Deliver the file: Place the crafted binary in a location accessible to a radare2 user or automated analysis pipeline (e.g., upload to a file analysis service, submit to a CI/CD pipeline, or social-engineer a user into opening it).
3. Trigger the crash: The target opens the file with a vulnerable version of radare2 (≤ 6.0.5): radare2 crash_002.bin. During binary loading, r_bin_open_io → r_bin_file_new_from_buffer → r_bin_object_new → r_bin_object_set_items → info() is called, which dereferences the NULL ne->os pointer via strdup() at bin_ne.c:83.
4. Denial of service achieved: radare2 crashes with SIGSEGV, terminating the process and disrupting any automated analysis workflow relying on it (Marlink Advisory, GitHub Issue).

• Process: radare2 process terminating unexpectedly with signal SIGSEGV (exit code 139) when processing NE-format binary files.
• Logs: AddressSanitizer output containing SEGV on unknown address 0x000000000000 and stack trace referencing info in bin_ne.c:83, strdup, or __sanitizer::internal_strlen; error message runtime error: null pointer passed as argument 1, which is declared to never be null.
• File System: Presence of unexpected or anomalous .bin files (particularly NE-format) submitted to analysis directories or pipelines, especially files with truncated or malformed NE headers (Marlink Advisory).

The vulnerability is patched in commit 6c5df3f8570d4f0c360681c08241ad8af3b919fd, which is included in radare2 builds after version 6.0.5. Users should update radare2 to any version incorporating this commit or later. As a workaround, avoid processing untrusted NE binary files with radare2 ≤ 6.0.5, and restrict automated pipelines from ingesting unvalidated binary inputs until the patch is applied (Patch Commit, Marlink Advisory).

The vulnerability was responsibly disclosed by Vlatko Kosturjak of Marlink Cyber, who filed the GitHub issue and published advisory MCSAID-2025-001. The radare2 maintainers responded quickly, merging a fix on the same day it was reported (2025-10-08). Community reaction has been minimal given the low severity and limited exploitability of the issue (Marlink Advisory, GitHub Issue).