CVE-2025-1786
Published: 01 March 2025
Summary
CVE-2025-1786 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Rizin Rizin. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-10 (Software Usage Restrictions).
Deeper analysis
CVE-2025-1786 is a buffer overflow vulnerability affecting rizin, an open-source reverse engineering framework developed by rizinorg, in versions up to 0.7.4. The flaw exists in the msf_stream_directory_free function within the library file /librz/bin/pdb/pdb.c and is triggered by manipulation of the -P command-line argument. It has been classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Exploitation requires local access to the affected system. A low-privileged local attacker can trigger the buffer overflow without user interaction, potentially achieving limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the rizin process scope.
Advisories recommend upgrading to rizin version 0.8.0, which resolves the issue. A proof-of-concept exploit has been publicly disclosed, including a downloadable archive from GitHub. Additional details are available in rizin GitHub issue #4893, milestone 18, and VulDB entries at ctiid.298007 and id.298007.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5885
Vulnerability details
A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the library /librz/bin/pdb/pdb.c. The manipulation of the argument -P leads to buffer overflow. Local access is required…
more
to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.0 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow in CLI reverse-engineering tool (rizin) via crafted -P argument enables arbitrary code execution in the context of the executing user, directly mapping to client-side exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of system flaws, directly addressing this buffer overflow vulnerability through upgrading rizin to the patched version 0.8.0.
Provides memory protection safeguards like non-executable memory regions and address space layout randomization to mitigate exploitation of the buffer overflow in rizin.
Establishes restrictions on software usage to prohibit execution of vulnerable rizin versions up to 0.7.4 on organizational systems.