CVE-2026-81881

Katalog CVE

CVSS 4.4 · Medium EPSS 0,13%

Kerentanan Out-of-bounds Read pada radare2. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/radareorg/radare2/issues/26229 exploit · issue tracking · mitigasi · advisory vendor
• https://github.com/radareorg/radare2/security/advisories/GHSA-q4w7-225g-64j9 patch · advisory vendor
• https://github.com/radareorg/radare2/commit/1da6e782df220edf56138ef5fe4f33745b04db74 patch
• https://github.com/radareorg/radare2/releases/tag/6.2.0 release notes