radareorg radare2 up to 6.1.x CPython Bytecode .pyc Marshal Parser memory corruption

Summaryinfo

A vulnerability labeled as problematic has been found in radareorg radare2 up to 6.1.x. Affected by this vulnerability is an unknown functionality of the component CPython Bytecode .pyc Marshal Parser. The manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-81878. The attack must be initiated from a local position. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in radareorg radare2 up to 6.1.x. Affected is an unknown part of the component CPython Bytecode .pyc Marshal Parser. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. CVE summarizes:

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated. This issue is fixed in version 6.2.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-81878 since 08/27/2026. The exploitability is told to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

Upgrading to version 6.2.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Tool Software

Vendor

• radareorg

Name

• radare2

Version

• 6.0
• 6.1

License

• open-source

Website

• Product: https://github.com/radareorg/radare2/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion