Read the docs
TI-2026-56496 Aliases CVE-2026-81885

radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

Priority MEDIUM 58CWE-770Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed radare2 (radareorg): 6.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
radareorgradare2before 6.2.06.2.0Patch availableCNA
  • radare2 Vendorradareorg Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*before 6.2.0Vulnerableradareorg
  • cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·radareorg

Remediation

  • Fix · CNA radare2 (radareorg) Fixed in 6.2.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81885

References

Exploit 1

Patch 3

Other 1

  • TI-2023-25089 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function… CVSS 3.1CRITICAL 9.8
  • TI-2023-25088 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu… CVSS 3.1CRITICAL 9.8
  • TI-2021-12172 Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. CVSS 3.1CRITICAL 10.0
  • TI-2026-07640 radare2 6.1.5 Use-After-Free via gdbr_pids_list() CVSS 4.0HIGH 8.7
  • TI-2026-07639 radare2 6.1.5 Use-After-Free via gdbr_threads_list() CVSS 4.0HIGH 8.7
  • TI-2023-03993 Heap-based Buffer Overflow in radareorg/radare2 CVSS 3.1CRITICAL 9.8
See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences