What’s Vulnerable › Vulnerabilities

CVE-2026-81879: radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-22 · updated 2026-09-25
• Weakness: CWE-125

Description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.

Affected products

• radareorg/radare2: before 6.2.0 — fixed in 6.2.0

How to fix

Upgrade to a fixed version: radareorg/radare2 6.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e
• https://github.com/radareorg/radare2/issues/26223
• https://github.com/radareorg/radare2/pull/26178
• https://github.com/radareorg/radare2/releases/tag/6.2.0
• https://github.com/radareorg/radare2/security/advisories/GHSA-jqfq-hvcp-xh4p
• https://github.com/radareorg/radare2/issues/26223

Get alerted when CVE-2026-81879 or the next vulnerability affects your stack