ZeroDay Findings
Sign inSign up

Findings

CVE-2026-31053

A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record().

Published Apr 6, 2026 · updated Jun 17, 2026 · rizin rizin

A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially crafted LE binary can trigger heap corruption and cause the application to crash, resulting in a denial-of-service condition. An attacker with a crafted binary could cause a denial of service when the tool is integrated on a service pipeline.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 6, 2026 · NIST NVD

    Detected

    A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially crafted LE binary can trigger heap corruption and cause the application to crash, resulting in a denial-of-service condition. An attacker with a crafted binary

  2. Jun 17, 2026 · NIST NVD

    Updated

    A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially crafted LE binary can trigger heap corruption and cause the application to crash, resulting in a denial-of-service condition. An attacker with a crafted binary

Affected

  • cpe rizin/rizin0.8.1

Sources

  • CVE.orgVulnerability recordCVE-2026-31053

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-31053

    A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing malformed or circular LE fixup chains, relocation entries may be freed multiple times during error handling. A specially crafted LE binary can trigger heap corru

    nvd.nist.gov

References