CVE-2026-81884

Katalog CVE

CVSS 3.3 · Low EPSS 0,15%

Kerentanan Out-of-bounds Read pada radare2. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/radareorg/radare2/issues/26226 exploit · issue tracking · mitigasi · advisory vendor
• https://github.com/radareorg/radare2/security/advisories/GHSA-c2g2-2mc7-3x5w patch · advisory vendor
• https://github.com/radareorg/radare2/commit/a73de09fea7516f65c14917d66113316ec7e7d6e patch
• https://github.com/radareorg/radare2/pull/26193 patch
• https://github.com/radareorg/radare2/releases/tag/6.2.0 release notes