CVE-2026-81885: radare radare2

Vulnerability summary

CVE-2026-81885 is a medium (CVSS 5.5) vulnerability in radare radare2. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 25-09-2026
   Last modifiedVulnerability information updated.

Description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.