radare2's Apple Preferred Executable Format loader can accept a malformed relocSecCount value that is not constrained by the number of sections or relocation records in the input. When a crafted PEF file is auto‑detected by radare2, the loader may iterate up to 268,435,456 relocation‑section cycles and repeatedly perform buffer operations beyond the end of the file. This uncontrolled processing leads to excessive CPU consumption and can keep radare2 busy for extended periods, effectively denying service to legitimate workloads. The vulnerability is rooted in CWE‑400 and CWE‑834 weaknesses related to input validation and resource handling.

All installations of radare2 older than version 6.2.0 are affected. The vulnerability exists in the radare2 framework and command‑line toolset distributed by radareorg. Systems that use radare2 for parsing Apple PEF files, especially when processing binaries from untrusted or externally supplied sources, are within the scope. Version 6.2.0 and later incorporate a fix that bounds the relocation processing loop.

The CVSS score of 5.5 indicates moderate severity. Because the exploit does not require elevated privileges and only needs a crafted PEF file that the loader will automatically detect, the likelihood of exploitation is high in environments where radare2 is exposed to untrusted binaries. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the absence of these metrics does not mitigate the risk. Attackers can trigger the denial of service from a remote interface that accepts binary files, such as a file upload endpoint that uses radare2 under the hood. Without timely patching, affected systems could experience prolonged CPU usage and degraded performance.