CVE-2026-81881: radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
What attacker interaction is required to trigger this issue?
An attacker needs to provide a crafted Mach-O file containing Swift type or class metadata and have it parsed by radare2. User interaction is required, such as opening or analyzing the malicious file.
Which installations are affected?
radare2 versions prior to 6.2.0 are affected when they parse Mach-O Swift field metadata. Version 6.2.0 contains the fix.
What is the likely impact if exploitation succeeds?
The out-of-bounds read can cause incorrect metadata processing or terminate the radare2 process. No attacker-observable memory disclosure has been demonstrated.
How can teams reduce exposure before upgrading?
Avoid parsing untrusted Mach-O files that include Swift type or class metadata until radare2 can be upgraded to 6.2.0.