radare2, a reverse engineering CLI and framework, contains a flaw in its ELF parsing logic. Prior to the 6.2.0 release, the application allocated an array for program headers based on the resolved PN_XNUM count, but many consumers still iterated using the original e_phnum value of 65535. When a crafted ELF file sets e_phnum to 0xffff and provides a smaller resolved count in shdr[0].sh_info, consumers read past the end of the allocated array, triggering a heap out‑of‑bounds read. The result is a process termination that results in a denial of service; memory disclosure or code execution have not been demonstrated.

The vulnerability affects radareorg's radare2 before version 6.2.0. All builds prior to that release can be impacted by a malicious ELF file with the described characteristics. Users running earlier releases should evaluate whether their environment processes untrusted binaries.

The CVSS base score is 5.5, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the KISA KEV catalog. The likely attack vector is local or remote execution of radare2 against a crafted ELF file; the attacker must supply the malicious file to radare2 for parsing. Because only a denial‑of‑service outcome has been verified, the risk is limited to service interruption rather than data exposure or arbitrary code execution.