The vulnerability originates in radare2’s CPython bytecode (.pyc) marshal parser. Before version 6.2.0 the parser accepts a 32‑bit string length field and does not guard against values that overflow the size+1 allocation. When a crafted .pyc file uses a length of 0xffffffff, the resulting allocation size wraps to zero and the subsequent reader writes attacker‑controlled data beyond the allocated heap block. This out‑of‑bounds write corrupts heap memory; it can crash the process, producing a denial of service, and may be leveraged to execute arbitrary code, though such exploitation has not yet been demonstrated. The impact is therefore defined as heap corruption with a potential for remote code execution but with immediate risk of service interruption.

This issue affects the radare2 project when the radare2 binary is earlier than release 6.2.0. The affected vendors include radareorg, and the product is radare2, a UNIX‑like reverse engineering framework and command‑line toolset. Any installation relying on the CPython bytecode parser for opening or inspecting .pyc files is vulnerable. Versions older than 6.2.0 should be addressed promptly.

CVSS score 5.5 indicates moderate severity, and the EPSS score is not provided. Since the issue is not listed in the CISA KEV catalog and no active exploits are known, the likelihood of a successful remote exploitation is currently low. Nevertheless, the denial of service effect can disrupt critical analysis workflows. The attack vector is inferred to be local or remote file injection via the r2 or rabin2 commands when a malicious .pyc file is processed. The vulnerability can be triggered without user interaction beyond providing the crafted file to radare2.