CVE-2026-81881
Received Received - Intake

Heap Overflow in radare2 Mach-O Swift Parser

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-81881
EUVD
EUVD-2026-84502

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
radareorg radare2 6.2.0
radareorg radare2 to 6.1.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in radare2's Mach-O Swift field-metadata parser. It occurs when parsing crafted Mach-O files where an attacker-controlled relative pointer is subtracted from the base address of the Swift field-metadata section without proper validation. This can result in a negative index, causing a read of four bytes before the allocated buffer. The issue affects radare2 versions through 6.1.8 and may lead to incorrect metadata processing or process termination.

Detection Guidance

To detect this vulnerability, check the installed version of radare2 using 'radare2 -v' or 'rabin2 -v'. If the version is 6.1.8 or earlier, the system is vulnerable. Additionally, inspect Mach-O files for crafted Swift metadata sections like __swift5_types and __swift5_fieldmd using 'rabin2 -cc <file>' to analyze class metadata parsing.

Impact Analysis

This vulnerability may cause incorrect metadata processing or terminate the radare2 process when parsing a crafted Mach-O file. While no memory disclosure has been demonstrated, it could lead to crashes or unexpected behavior during reverse engineering tasks. The impact is limited to availability (low severity) and requires local access to exploit.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not involve data disclosure or unauthorized access. The primary impact is on system availability due to potential crashes. No evidence suggests confidentiality or integrity breaches, so compliance risks are minimal.

Mitigation Strategies

Upgrade radare2 to version 6.2.0 or later immediately. If upgrading is not possible, avoid parsing untrusted Mach-O files with radare2 tools like rabin2 or rizin. Monitor for crashes during Swift metadata parsing as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81881. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart