A relative Swift field pointer in radare2’s Mach‑O Swift metadata parser can be lower than the field‑metadata section base, causing subtraction to produce a negative logical index. The parser then reads four bytes immediately before the allocated buffer, leading to an out‑of‑bounds read. This results in either incorrect metadata handling or process termination. No memory disclosure has been demonstrated, so the impact is limited to local exploitation that may destabilise the analysis tool.

The vulnerability exists in radareorg’s radare2 product, specifically in all versions prior to 6.2.0. Users running radare2 6.1.x or earlier are affected.

The CVSS score of 3.3 indicates low severity. The EPSS score is not available and the issue is not listed in CISA KEV catalogs, suggesting limited public exploitation. The attack vector is local – a threat actor needs only a crafted Mach‑O file to trigger the flaw when opened with radare2. As such, the risk is confined to environments that routinely process malicious or suspicious binaries with this tool.