CVE-2026-81884 in radare2
Summary
by MITRE • 09/22/2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within radare2 prior to version 6.2.0 resides specifically in the Mach-O LC_DATA_IN_CODE parser, a component responsible for interpreting code information data structures embedded within Mach-O binary files commonly used on macOS and iOS platforms. This flaw stems from an insufficient validation of input parameters during the parsing process, where the software blindly trusts the values provided by the file header for the offset (dataoff) and size (datasize). The core technical deficiency lies in the failure to ensure that the datasize is a multiple of the data_in_code_entry structure size. When this condition is not met, the parser proceeds with an iteration logic that does not account for partial records at the end of the buffer. Consequently, during the final iteration of processing these entries, the application attempts to read beyond the boundaries of the allocated memory buffer. This behavior constitutes a classic heap out-of-bounds read vulnerability, classified under CWE-125 in industry standards as an Out-of-Bounds Read flaw where software reads data past the end or before the beginning of the intended buffer.
The operational impact of this vulnerability is primarily centered on stability and availability rather than confidentiality or integrity at first glance. Because the parser accesses memory outside its allocated bounds, it can lead to undefined behavior that typically manifests as a process termination or crash when the non-default bin.verbose option is enabled during the analysis of a crafted Mach-O file. While no attacker-observable memory disclosure has been demonstrated in this specific context, heap out-of-bounds reads are inherently dangerous because they expose adjacent memory contents which may contain sensitive information such as pointers, keys, or other binary data depending on the runtime environment and allocation patterns. The attack vector involves an adversary supplying a maliciously crafted Mach-O file to a victim who is using radare2 with verbose logging enabled, triggering the out-of-bounds access upon opening the file for reverse engineering analysis. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, if considered in the broader context of tool exploitation, though more directly it represents an input validation failure leading to denial of service through application crash.
Mitigation strategies focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade radare2 to version 6.2.0 or later, where this parsing logic has been corrected to properly validate that the datasize aligns with entry boundaries before processing records. For environments unable to immediately update, disabling the bin.verbose option during the analysis of untrusted Mach-O binaries can prevent the trigger condition from activating the vulnerable code path. Furthermore, developers and security engineers should implement strict input validation for all binary format parsers, ensuring that size fields are verified against buffer limits and that iteration loops account for partial data at boundaries to prevent out-of-bounds access. This incident underscores the importance of rigorous boundary checks in reverse engineering tools that handle arbitrary external inputs, as even minor parsing errors can lead to significant stability issues or potential security compromises.