CVE-2026-4174: Radare2 Mach-O File mach0.c walk_exports_trie resource consumption

Vulnerability summary

CVE-2026-4174 is a medium (CVSS 4.8) Uncontrolled Resource Consumption vulnerability in radare2 Ubuntu. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-03-2026
   PublishedVulnerability first disclosed.
2. 17-03-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. Upgrading to version 6.1.2 is capable of addressing this issue. The name of the patch is 4371ae84c99c46b48cb21badbbef06b30757aba0. You should upgrade the affected component. The code maintainer states that, "[he] wont consider this bug a DoS".

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.