The vulnerability is an infinite fault relocation‑chain loop in radare2's NE relocation parser. When a crafted NE executable contains a relocation entry that points back to itself, the parser enters an endless cycle, allocating a new relocation object on each iteration. This results in escalating CPU usage and memory consumption until the system becomes unresponsive, effectively providing a denial of service to any process that attempts to parse such a file. The weakness is a resource exhaustion flaw, bounded by CWE‑770 (Unlimited Resource Consumption) and CWE‑835 (Infinite Loop).

radareorg's radare2 reverse engineering framework prior to version 6.2.0. The 6.2.0 release includes a fix that introduces a processing limit and cycle detection in the NE relocation parser, making earlier versions susceptible to this denial of service attack. Users running radare2 versions earlier than 6.2.0 on any UNIX‑like platform are affected.

The vulnerability’s CVSS score of 5.5 indicates moderate severity. No EPSS data is available, meaning the probability of exploitation is unknown, and the issue is not listed in CISA’s KEV catalog. The attack requires the ability to provide a malicious NE executable to radare2, typically through local file access or by moving a crafted file into a trusted directory. An attacker who can run radare2 against the crafted file will experience significant CPU and memory exhaustion, leading to service interruption. The lack of mitigations in the parser (no loop counter or cycle detection) makes the exploit straightforward for a local adversary. No public exploit has been documented, but the exploitability is high for the applicable user base.