Denial of Service Vulnerability in radare2 Framework by radareorg

CVE-2026-81885

What is CVE-2026-81885?

The radare2 reverse engineering framework was found to have a vulnerability in its NE relocation fixup-chain parser prior to version 6.2.0. The issue arises when processing a specially crafted NE executable that introduces a fixup chain leading back to itself, resulting in an infinite loop of parsing. This unchecked iteration can lead to significant CPU and memory resource consumption, ultimately causing a denial of service. The vulnerability has been addressed in version 6.2.0, where proper iteration limits and cycle detection mechanisms have been implemented.

References