CVE-2026-81879: radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PNXNUM count but several consumers still iterated with the original ephnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with ephnum = 0xffff and a much smaller resolved count in shdr[0].shinfo. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users or services that run radare2 on untrusted or attacker-supplied ELF files are exposed. Exploitation requires local access and user interaction to process the crafted file.
What does an attacker need to provide to trigger the flaw?
The attacker needs a crafted ELF file whose e_phnum field is 0xffff while the resolved program-header count in shdr[0].sh_info is much smaller. Processing that file can make affected consumers read beyond the allocated program-header array.
What is the practical impact of successful exploitation?
The demonstrated impact is a heap out-of-bounds read that can terminate the radare2 process, causing denial of service. Memory disclosure and code execution have not been demonstrated.
How can I remediate this vulnerability?
Upgrade radare2 to version 6.2.0 or later. The issue affects versions prior to 6.2.0.