p PatchFirst

CVE-2026-81879

CVE-2026-81879 · radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.

CVSS 5.5 · Medium · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • radare2

    Versions
    • < 6.2.0: Affected

    No fix published

  • radare2 Ubuntu:16.04:LTS

    Versions
    • 0.9.6-3.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.6.0+dfsg-1
    • 2.0.0+dfsg-1
    • 2.1.0+dfsg-1
    • 2.3.0+dfsg-1
    • 2.3.0+dfsg-2
    • 2.3.0+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:20.04:LTS

    Versions
    • 3.2.1+dfsg-5build1
    • 4.0.0+dfsg-1
    • 4.2.1+dfsg-1
    • 4.2.1+dfsg-2
    • 4.2.1+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:Pro:24.04:LTS

    Versions
    • 5.5.0+dfsg-1ubuntu1
    • 5.5.0+dfsg-1.1ubuntu2
    • 5.5.0+dfsg-1.1ubuntu3
    • 5.5.0+dfsg-1.1ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:26.10

    Versions
    • 6.0.7+ds-1
    • 6.1.6+ds-2
    • 6.1.6+ds-3
    • 6.1.8+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • radare2 Ubuntu:26.04:LTS

    Versions
    • 5.9.8+dfsg-2
    • 6.0.4+dfsg-1
    • 6.0.7+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →