CVE-2026-81886: radare2: Uncontrolled memory allocation in radare2 dmp64 parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size. This can cause denial of service through excessive memory consumption and processing time. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running radare2 versions before 6.2.0 who open Windows 64-bit full-memory crash dumps are exposed. The affected component is the dmp64 parser.
What must an attacker do to trigger the denial of service?
An attacker must provide a small crafted full-memory Windows crash dump and have it opened by radare2. No privileges are required, but user interaction is required to open the malicious dump.
Are normal crash dumps affected?
The available information identifies crafted full-memory Windows crash dumps as the trigger. It does not state that other dump types or ordinary crash dumps are affected.
What should be done if immediate patching is not possible?
Avoid opening untrusted or unvalidated Windows 64-bit full-memory crash dumps with affected radare2 versions. The described impact is excessive memory consumption and processing time.
How can I determine whether my installation is affected?
Check the radare2 version in use. Versions prior to 6.2.0 are affected; version 6.2.0 contains the fix.