CVE-2026-4174

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4174
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4174.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4174
Downstream
Published
2026-03-15T10:32:10.553Z
Modified
2026-07-15T17:36:08.573691Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Radare2 Mach-O File mach0.c walk_exports_trie resource consumption
Details

A vulnerability has been found in Radare2 5.9.9. This issue affects the function walkexportstrie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. Upgrading to version 6.1.2 is capable of addressing this issue. The name of the patch is 4371ae84c99c46b48cb21badbbef06b30757aba0. You should upgrade the affected component. The code maintainer states that, "[he] wont consider this bug a DoS".

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.9.9"
                },
                {
                    "last_affected": "5.9.9"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-400",
        "CWE-404"
    ],
    "cna_assigner": "VulDB",
    "isDisputed": true,
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4174.json"
}
References

Affected packages

Git / github.com/toddawalter/radare2

Affected ranges

Type
GIT
Repo
https://github.com/toddawalter/radare2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4371ae84c99c46b48cb21badbbef06b30757aba0
Database specific 
{
    "source": "REFERENCES"
}

Database specific

vanir_signatures_modified 
"2026-07-15T17:36:08Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "142196495732989083952396346693228342323",
                "234118510478057294026385545460842961741",
                "179539200476313868998545233872552719877",
                "8996478778593505059088204477756130279",
                "64858235625872399150398962564065023629",
                "170511231471455087235683705447743259075",
                "259964847177114049916284976928847688511",
                "76930989746751669727092111474141649000",
                "202950227292545415636023045926404986400",
                "66627040926471146057570493175702674075",
                "333764995835203698557592464208859367880",
                "326299835490000309165908199556731873825",
                "280513691181157568494018699679404610411",
                "40654343988445973367470647450975683268",
                "289610627381001427931953087787362524473",
                "295935485398893110300561587178297648383",
                "77863303345343446391395868867251117134",
                "322149803007119750341475188527557691305",
                "60170750650228589476058012977142449839",
                "248776575511595703254964828356328740710",
                "263718479385209546021431206186705938010",
                "266016676274947636121228455903839161863",
                "188806452010473003307526868928489389012",
                "214541991886172315783354666437158117636",
                "333444218175150107349902340247168669826",
                "263553671563234230575284345397628086460",
                "234068548800643205951003092898711760643",
                "72160168675433987880953309214639017228",
                "320205759847025276247926286415193567570",
                "324383719627388250169252852970914740896",
                "129472967678828384630638955576156116638",
                "294187594236248694939368414737908004902",
                "50563973003021737785163027650481329791",
                "76777546499117694792455940150321312821",
                "41323712714427693409088173164119210324",
                "118850882996222751126062672907762277776",
                "243161179089118522174147047986256025101",
                "313638895594007774300337332266939999040",
                "37620223958608704024582071070117763517",
                "27575915509688533252532461955776328457",
                "161575599145298539575085638986272256731",
                "157819865482841173478998666477262416527",
                "85464429588698895127650099116506075467",
                "166968411156221333735904855792496938034",
                "152107253334803460014266445690488769582",
                "316979166449615729636317986013560490096",
                "60210416465790803159700460772875897718",
                "40548888382721386416651193902985823068",
                "196224283061750880459641113702288488470",
                "161280264838002366318937442819627359999",
                "72488967664517078250644837173821689961",
                "232005051063837734307575037207962903790",
                "19986336617405558205862061214240837589",
                "89895461693637798184451849336054453263",
                "108379081985990510925704843922865651402",
                "138055397897479015369770520622436619232",
                "275773925929331167404920391762795380560",
                "141233085168473328136956976612509754673",
                "177243510891827968373928224584974489152",
                "18203915665459612612710892464966405724",
                "64077128966760733292791572633955345538",
                "61944294943975012874078141932774986677",
                "21811128353334499782704594997540739903",
                "259039894339226913431657427837669054704",
                "31300263140000120154105674685694464145",
                "147630223296588399214495365092308689026",
                "207253213448836816723938273594401912694",
                "108603681786180692899320493209450678561",
                "148147377082462834358787533997876033284",
                "46448062813997579928156620826129707689",
                "302464660227134524940351032069375673745",
                "134358111909978326891382060270828961531",
                "206822836077085520185043460035086089704",
                "298475734962550518386506765183989671303",
                "209437688654006823348287100580326737483",
                "126292991301963344058966373498108061704",
                "310976768348812136724022062357327673407",
                "56692785355840005892853957168506299639",
                "177735488593516479388065728382595168353",
                "71789485133742872813290624749793711847",
                "32310470122414365360255128970994796940",
                "268359816890341035748547132711914600511",
                "265296627231191344348516330237779557296",
                "32029649100524360219053944330415113944",
                "234101513997281450503580890018863866055",
                "281971248596970562184963130403740447341",
                "325608911563856591681838940497495996291",
                "72750954903512450675444232442054557415",
                "77788817801380689266918427499900954863",
                "43382989809449035164217345398535615073",
                "115951468810408215825880880495541098746",
                "251026670540851079587755681551533325228"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/toddawalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0",
        "id": "CVE-2026-4174-4e69acfb",
        "target": {
            "file": "libr/bin/format/mach0/mach0.c"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1955.0,
            "function_hash": "323464168206330952485700540502452818145"
        },
        "signature_version": "v1",
        "source": "https://github.com/toddawalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0",
        "id": "CVE-2026-4174-fdabc149",
        "target": {
            "function": "walk_bind_chains_callback",
            "file": "libr/bin/format/mach0/mach0.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4174.json"