Heap Out-of-Bounds Read in radare2 ELF Parser Affects Multiple Versions

CVE-2026-81879

What is CVE-2026-81879?

The radare2 reverse engineering framework contains a vulnerability in its ELF parser that becomes apparent when handling crafted ELF files. When the program header number (e_phnum) is set to the maximum value, and the actual resolved count is significantly smaller, the system allows iteration beyond the boundaries of the allocated program-header array. This flaw could lead to a denial of service due to process crashes. While memory disclosure and code execution haven't been confirmed, users are strongly advised to update to radare2 version 6.2.0 or later to mitigate potential risks associated with this vulnerability.

References