CVE-2019-14745

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.

• CWE-77

• https://bananamafia.dev/post/r2-pwndebian/Exploit, Third Party Advisory
• https://github.com/radare/radare2/pull/14690Patch, Third Party Advisory
• https://github.com/radare/radare2/releases/tag/3.7.0Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETWG4VKHWL5F74L3QBBKSCOXHSRNSRRT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGA2PVBFA6VPWWLMBGWVBESHAJBQ7OXJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQO7V37RGQEKZDLY2JYKDZTLNN2YUBC5/
• https://bananamafia.dev/post/r2-pwndebian/Exploit, Third Party Advisory
• https://github.com/radare/radare2/pull/14690Patch, Third Party Advisory
• https://github.com/radare/radare2/releases/tag/3.7.0Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETWG4VKHWL5F74L3QBBKSCOXHSRNSRRT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGA2PVBFA6VPWWLMBGWVBESHAJBQ7OXJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQO7V37RGQEKZDLY2JYKDZTLNN2YUBC5/

Published

Aug 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14733AdPlug 2.3.1 has multiple heap-based buffer overflows in Cra…8.8
• CVE-2019-14734AdPlug 2.3.1 has multiple heap-based buffer overflows in Cmt…8.8
• CVE-2019-14737Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.7.8
• CVE-2019-1474An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-14743In Valve Steam Client for Windows through 2019-08-07, HKLM\S…
• CVE-2019-14744In KDE Frameworks KConfig before 5.61.0, malicious desktop f…7.8
• CVE-2019-14746A issue was discovered in KuaiFanCMS 5.0. It allows eval inj…
• CVE-2019-14747DWSurvey through 2019-07-22 has stored XSS via the design/my…
• CVE-2019-14748An issue was discovered in osTicket before 1.10.7 and 1.12.x…5.4
• CVE-2019-14749An issue was discovered in osTicket before 1.10.7 and 1.12.x…8.8
• CVE-2019-1475Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14750An issue was discovered in osTicket before 1.10.7 and 1.12.x…6.1