CVE-2026-81879
Received Received - Intake

Heap Out-of-Bounds Read in radare2 ELF Parser

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-81879
EUVD
EUVD-2026-84504

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
radareorg radare2 to 6.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in radare2's ELF parser. It occurs when processing crafted ELF files where the program-header count field (e_phnum) is set to 65535 (PN_XNUM). The parser allocates a buffer based on the actual count stored in a section header but some code still uses the original 65535 value for loops. This causes the program to read beyond the allocated memory, leading to crashes or denial of service.

Detection Guidance

To detect this vulnerability, check the installed version of radare2 on your system. If it is below 6.2.0, the system is vulnerable. Use commands like 'radare2 -v' or 'apt list --installed | grep radare2' to verify the version.

Impact Analysis

The main impact is denial of service. When processing a malicious ELF file, radare2 may crash due to reading invalid memory. This could disrupt tools or services relying on radare2 for reverse engineering or file analysis. Memory disclosure or code execution is not demonstrated but cannot be ruled out entirely.

Compliance Impact

This vulnerability primarily affects availability by causing crashes. It does not directly impact data confidentiality or integrity. However, denial of service could disrupt systems handling sensitive data, potentially leading to compliance violations if service availability is required by regulations like GDPR or HIPAA.

Mitigation Strategies

Upgrade radare2 to version 6.2.0 or later immediately. Avoid processing untrusted ELF files with vulnerable versions. Monitor for crashes or unusual behavior when handling ELF files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81879. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart