CVE-2026-81880 in radare2
Summary
by MITRE • 09/22/2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The radare2 reverse engineering framework serves as a critical tool for security professionals, developers, and researchers engaged in binary analysis, disassembly, and debugging across various operating systems including macOS. Within this ecosystem, the Apple Preferred Executable Format loader plays a specific role in parsing legacy Mac OS application binaries that utilize the PEF container format. Prior to version 6.2.0, this component contained a significant input validation flaw related to how it processed relocation section counts and record offsets during the auto-detection phase of binary analysis. This vulnerability highlights the risks associated with trusting metadata values embedded within untrusted file formats without rigorous boundary checking, particularly in tools that are designed to handle arbitrary inputs from potentially malicious sources.
The technical root cause of this vulnerability lies in the absence of bounds checking for the relocSecCount field and subsequent relocation record offsets. When radare2 encountered a crafted Apple PEF file, its auto-detection mechanism would identify it as such and invoke the corresponding loader. The loader then read the number of relocation sections specified within the file header without verifying that this value was consistent with the actual size or structure of the input data. Consequently, if an attacker provided a maliciously constructed PEF file where relocSecCount contained an excessively large integer, typically near the maximum limit for signed 32-bit integers such as two hundred sixty-eight million four hundred thirty-five thousand four hundred fifty-six, the application would attempt to iterate through that many sections. This logic error allows the parser to proceed with processing data even when record offsets exceed the end of the file buffer, leading to out-of-bounds reads or invalid memory access patterns depending on the specific implementation details of the iteration loop.
The operational impact of this flaw is primarily a denial of service condition characterized by excessive CPU consumption and prolonged processing times rather than immediate remote code execution. Because the loader enters an extremely large number of iterations based on the unbounded count, it consumes significant computational resources while attempting to process non-existent or invalid relocation records. This behavior can cause radare2 to hang indefinitely or consume system memory and processor cycles at a rate that renders the host machine unusable for other tasks. For users who rely on automated scanning pipelines or batch processing of binary files, this vulnerability could be exploited to disrupt workflows by causing resource exhaustion through simple file submission. The attack vector is considered local in nature since it requires the user to open or analyze a specific crafted file within the radare2 environment, making it an issue relevant to social engineering attacks where users are tricked into analyzing malicious binaries.
From a classification perspective, this vulnerability aligns with CWE-134: Use of Externally-Controlled Format String and more accurately CWE-787: Out-of-bounds Write or Read depending on the exact memory access pattern during iteration, though it is most commonly categorized under CWE-20: Improper Input Validation. In terms of adversary tactics, this flaw could be leveraged within ATT&CK technique T1496: Resource Hijacking to degrade system performance and availability. The lack of validation against structural integrity constraints represents a fundamental failure in defensive coding practices for parsers that handle complex binary formats with variable-length fields or count-based structures.
Mitigation strategies focus on the immediate application of vendor-provided patches as well as operational safeguards within security workflows. Users running radare2 must upgrade to version 6.2.0 or later, where the developers have implemented proper bounds checking for relocation section counts and record offsets. This fix ensures that the loader validates whether the specified number of sections exceeds the actual data available in the file before initiating processing loops. Additionally, organizations utilizing automated binary analysis tools should implement resource limits such as CPU time quotas and memory caps on processes executing third-party parsers to contain potential denial-of-service impacts even if new vulnerabilities are discovered. Regular updates to reverse engineering frameworks are essential to maintain resilience against evolving threats targeting parser logic flaws in widely used security utilities.