Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Published: 2026-09-22
Score: 2.5 Low
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

radare2's Mach‑O LC_DATA_IN_CODE parser may read beyond the allocated buffer when it trusts dataoff and datasize fields. The bug can be triggered with a crafted Mach‑O file while the non‑default bin.verbose option is enabled, allowing a final partial record to be processed incorrectly. This results in a heap out‑of‑bounds read and can cause the process to terminate; no attacker‑observable memory disclosure has been reported. The weakness corresponds to CWE‑125.

Affected Systems

The vulnerability affects the radare2 framework from radareorg released before version 6.2.0. It is relevant to UNIX‑like operating systems where radare2 is installed.

Risk and Exploitability

The CVSS score of 2.5 indicates a low severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access to a machine running radare2 and the ability to open a crafted Mach‑O file while bin.verbose is enabled. Because the impact is limited to a process crash and there is no demonstrated information disclosure, the overall risk is low and the attack vector is local command execution.

Generated by OpenCVE AI on September 22, 2026 at 16:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update radare2 to version 6.2.0 or later to obtain the fixed parser implementation.
  • If an upgrade is not possible, disable the bin.verbose option to prevent the parser from processing the problematic data and eliminate the bug trigger.
  • Restrict the upload or execution of Mach‑O files to trusted sources and limit write permissions for the radare2 user to reduce the chance of a local attacker constructing a malicious file.

Generated by OpenCVE AI on September 22, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Radareorg
Radareorg radare2
Vendors & Products Radareorg
Radareorg radare2

Tue, 22 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Title radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

Subscriptions

Radareorg Radare2
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T15:40:10.955Z

Reserved: 2026-08-27T17:48:42.122Z

Link: CVE-2026-81884

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T16:18:03.347

Modified: 2026-09-22T16:18:03.347

Link: CVE-2026-81884

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T17:00:11Z

Weaknesses