Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-81881 EUVD-2026-84502

radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser

Published Sep 22, 2026 · Updated Sep 22, 2026 · Assigned by GitHub_M

Description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

Affected products

VendorProductAffectedFixed
radareorg radare2 < 6.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 radare2 No fix yet —
Ubuntu 26.04 LTS radare2 No fix yet —
Ubuntu 16.04 LTS radare2 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS radare2 No fix yet —
Ubuntu Pro 20.04 LTS radare2 No fix yet —
Ubuntu Pro 18.04 LTS radare2 No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 radare2 6.2.2-bp160.1.1 openSUSE-SU-2026:21988-1

Advisories 1

References