CVE-2026-81885Medium· 5.5▾ TwilightPoC availableradare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration l…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
Last analysed / modified upstream
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.
radare2 < 6.2.0Upgrade past the affected range:
radare2 6.2.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81886Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81878Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81883Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81879Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81884Low· 2.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81881Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset