CVE-2025-1786

MediumPublic PoC

Published: 01 March 2025

Published

01 March 2025

Modified

25 August 2025

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0003 9.8th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1786 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Rizin Rizin. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-10 (Software Usage Restrictions).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of system flaws, directly addressing this buffer overflow vulnerability through upgrading rizin to the patched version 0.8.0.

SI-16 Memory Protection partial match

prevent

Provides memory protection safeguards like non-executable memory regions and address space layout randomization to mitigate exploitation of the buffer overflow in rizin.

CM-10 Software Usage Restrictions partial match

prevent

Establishes restrictions on software usage to prohibit execution of vulnerable rizin versions up to 0.7.4 on organizational systems.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Local buffer overflow in CLI reverse-engineering tool (rizin) via crafted -P argument enables arbitrary code execution in the context of the executing user, directly mapping to client-side exploitation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the library /librz/bin/pdb/pdb.c. The manipulation of the argument -P leads to buffer overflow. Local access is required…

to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.0 is able to address this issue. It is recommended to upgrade the affected component.

Deeper analysisAI

CVE-2025-1786 is a buffer overflow vulnerability affecting rizin, an open-source reverse engineering framework developed by rizinorg, in versions up to 0.7.4. The flaw exists in the msf_stream_directory_free function within the library file /librz/bin/pdb/pdb.c and is triggered by manipulation of the -P command-line argument. It has been classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Exploitation requires local access to the affected system. A low-privileged local attacker can trigger the buffer overflow without user interaction, potentially achieving limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the rizin process scope.

Advisories recommend upgrading to rizin version 0.8.0, which resolves the issue. A proof-of-concept exploit has been publicly disclosed, including a downloadable archive from GitHub. Additional details are available in rizin GitHub issue #4893, milestone 18, and VulDB entries at ctiid.298007 and id.298007.