CVE-2026-81878 in radare2
Summary
by MITRE • 09/22/2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated. This issue is fixed in version 6.2.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The radare2 framework, a widely utilized UNIX-like reverse engineering toolset, contained a critical vulnerability within its CPython bytecode parsing logic prior to version 6.2.0. The core of the flaw resided in the marshal parser responsible for handling .pyc files, which are compiled Python script binaries often encountered during malware analysis and software reverse engineering tasks. Specifically, the implementation failed to adequately validate string length fields encoded within the CPython marshal format. When processing these structures, the reader accepted a 32-bit unsigned integer representing the string length without performing sufficient bounds checking against the memory allocation limits. This oversight allowed an attacker or malicious actor to supply a crafted .pyc file containing a manipulated header field with a value of 0xffffffff, which represents the maximum possible value for a signed 32-bit integer when interpreted in certain contexts or simply as a massive unsigned quantity that exceeds reasonable heap constraints.
Upon encountering this oversized length value during the parsing process, the underlying memory allocation routine experienced an arithmetic overflow condition. The system attempted to allocate memory based on the provided size plus one byte for null termination, but due to the magnitude of 0xffffffff, the calculation wrapped around to zero or a very small positive number depending on the specific integer type used in the allocation function. Consequently, only a minimal amount of heap memory was reserved. However, subsequent operations proceeded under the assumption that sufficient space had been allocated according to the original large length value. The common byte reader then attempted to write attacker-controlled data and fill bytes into this undersized buffer, resulting in a classic heap-based buffer overflow condition. This mismatch between expected allocation size and actual written data volume leads directly to memory corruption within the process address space.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service through application crashes caused by segmentation faults or general protection faults when the corrupted heap metadata triggers detection mechanisms in modern operating systems. Beyond stability issues, the nature of the heap overflow presents a significant risk for arbitrary code execution. By carefully crafting the input data and controlling the contents written beyond the allocated buffer boundary, an attacker could potentially overwrite adjacent heap structures such as function pointers or object headers. Although no public proof-of-concept demonstrating full remote code execution was available at the time of disclosure, the theoretical exploitability remains high given that radare2 is often used to analyze untrusted binaries from unknown sources. The vulnerability affects tools like r2 and rabin2 when they are invoked to open or inspect maliciously constructed .pyc files, making it a relevant threat in security research environments where automated analysis of Python-based malware samples occurs frequently.
From a classification perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound, as the root cause is the failure to handle large integer values correctly during memory size calculations. It also relates closely to CWE-787 Out-of-bounds Write, since data was written beyond the limits of the allocated buffer due to the incorrect allocation size derived from the overflowed length field. In terms of adversarial tactics, this vulnerability could be leveraged within ATT&CK technique T1203 Exploitation for Client Execution if an attacker tricks a user into opening a malicious .pyc file in radare2, potentially leading to initial access or further compromise depending on the privileges under which the tool is running.
Mitigation strategies focus primarily on software updates and operational hygiene. Users of radare2 must upgrade to version 6.2.0 or later, where the marshal parser has been patched to properly validate string lengths against available memory constraints before attempting allocation. This ensures that oversized values are rejected early in the parsing pipeline rather than causing downstream corruption. Additionally, security practitioners should exercise caution when analyzing untrusted .pyc files using reverse engineering tools until patches are applied. Implementing sandboxed environments for running radare2 can provide an additional layer of defense by limiting the impact of any potential exploitation attempts on the host system. Regularly updating toolchains and maintaining awareness of vulnerabilities in commonly used analysis utilities is essential to maintain a robust security posture against sophisticated threats that target developer and analyst workflows.