The vulnerability resides in the walk_exports_trie function of Radare2's Mach‑O file parser (libr/bin/format/mach0/mach0.c). An attacker can craft a Mach‑O binary that, when parsed, causes the function to consume excessive memory or CPU resources, leading to a denial‑of‑service condition. This weakness aligns with CWE‑1050 (Untrusted Resource Consumption), CWE‑400 (Resource Exhaustion), and CWE‑404 (Improper Resource Shutdown or Release).

Affected systems are installations of Radare2, specifically version 5.9.9 and any earlier releases that have not applied the bug fix. The fix is available in Radare2 6.1.2 and is identified by commit 4371ae84c99c46b48cb21badbbef06b30757aba0.

The CVSS score is 4.8, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to the Radare2 environment; an attacker must provide a malicious Mach‑O file to the vulnerable parser. Because the attack is local and the impact is resource consumption, the overall risk remains moderate to low.