CVE-2026-81884: radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of dataincodeentry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
Installations running radare2 versions prior to 6.2.0 are affected when they open a crafted Mach-O file with the non-default bin.verbose option enabled. The issue is local and requires user interaction.
What does an attacker need to do to trigger the flaw?
An attacker needs to provide a crafted Mach-O file whose LC_DATA_IN_CODE datasize is not a multiple of a data_in_code_entry. The target must open that file while bin.verbose is enabled.
What is the likely impact?
The out-of-bounds read can terminate the radare2 process. No attacker-observable memory disclosure has been demonstrated, and the available information does not describe an integrity impact.
What can be done before upgrading?
Keep the non-default bin.verbose option disabled and avoid opening untrusted Mach-O files in configurations where it is enabled. Upgrade to radare2 6.2.0 to obtain the fix.