CVE-2018-10186

In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368.

• CWE-125

• https://github.com/radare/radare2/issues/9915Exploit, Third Party Advisory
• https://github.com/radare/radare2/issues/9915Exploit, Third Party Advisory

Published

Apr 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10177In ImageMagick 7.0.7-28, there is an infinite loop in the Re…
• CVE-2018-10178The FromDocToPDF extension before 13.611.13.2303 for Chrome …5.3
• CVE-2018-1018A remote code execution vulnerability exists when Internet E…
• CVE-2018-10183An issue was discovered in BigTree 4.2.22. There is cross-si…
• CVE-2018-10184An issue was discovered in HAProxy before 1.8.8. The incomin…
• CVE-2018-10185An issue was discovered in TuziCMS v2.0.6. There is a CSRF v…
• CVE-2018-10187In radare2 2.5.0, there is a heap-based buffer over-read in …
• CVE-2018-10188phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attack…
• CVE-2018-10189An issue was discovered in Mautic 1.x and 2.x before 2.13.0.…
• CVE-2018-1019A remote code execution vulnerability exists in the way that…
• CVE-2018-10190A vulnerability in London Trust Media Private Internet Acces…
• CVE-2018-10191In versions of mruby up to and including 1.4.0, an integer o…9.8