CVE-2026-81884
Received Received - Intake

Heap Out-of-Bounds Read in radare2 Mach-O Parser

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-81884
EUVD
EUVD-2026-84468

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
radare2 radare2 to 6.2.0 (exc)
radare2 radare2 6.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in radare2's Mach-O LC_DATA_IN_CODE parser. When the non-default bin.verbose option is enabled, the parser reads dataoff and datasize values without validating if they fit within the file's bounds. If datasize is not a multiple of the entry size, the final iteration reads beyond the allocated buffer, causing a heap out-of-bounds read that may terminate the process.

Detection Guidance

To detect this vulnerability, check if you are running a vulnerable version of radare2 (6.1.8 or earlier) and if bin.verbose is enabled. Use commands like 'r2 -v' to check the version and 'r2 -e bin.verbose=true' to test if verbose mode is active. Inspect Mach-O files with 'r2 -a mach0 -e bin.verbose=true <file>' to see if crashes occur.

Impact Analysis

This vulnerability can cause radare2 to crash when processing a specially crafted Mach-O file with bin.verbose enabled. It may lead to process termination but does not allow memory disclosure or compromise of confidentiality or integrity. The impact is limited to availability and requires local access, high attack complexity, and user interaction.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not result in data disclosure or integrity breaches. However, if radare2 is used in environments requiring high availability or secure processing of Mach-O files, crashes could disrupt operations, potentially affecting compliance with availability-related requirements.

Mitigation Strategies

Upgrade radare2 to version 6.2.0 or later. If upgrading is not possible, disable the bin.verbose option when processing Mach-O files. Avoid using radare2 with verbose mode on untrusted files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart