CVE-2026-81879

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81879
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81879.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81879
Aliases
  • GHSA-jqfq-hvcp-xh4p
Downstream
Published
2026-09-22T15:09:01Z
Modified
2026-09-25T08:24:10Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
Details

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81879.json"
}
References

Affected packages

Git / github.com/radareorg/radare2

Affected ranges

Type
GIT
Repo
https://github.com/radareorg/radare2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9449b07579c19b6b187c1a0918fbec2cef1a036e
Fixed
e1fc278734ad62f933fc6f91edb29e4ba732f402
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.2.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.4-termux4
0.10.5
0.10.6
0.8.6
0.8.8
0.9
0.9.2
0.9.4
0.9.6
0.9.7
0.9.8
0.9.8-rc1
0.9.8-rc2
0.9.8-rc3
0.9.8-rc4
0.9.9
1.*
1.0
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.0-git
1.3.0
1.3.0-git
1.4.0
1.5.0
1.6.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.4.0
2.5.0
2.6.0
2.6.9
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.3.1
4.4.0
4.5.1
5.*
5.0.0
5.1.0
5.1.1
5.2.0
5.2.1
5.3.0
5.3.1
5.4.0
5.4.0-git
5.4.2
5.5.0
5.5.2
5.5.4
5.6.0
5.6.2
5.6.4
5.6.6
5.6.8
5.7.0
5.7.2
5.7.4
5.7.6
5.7.8
5.8.0
5.8.2
5.8.4
5.8.6
5.8.8
5.9.0
5.9.2
5.9.4
5.9.6
5.9.8
6.*
6.0.0
6.0.2
6.0.4
6.0.6
6.0.7
6.0.8
6.1.0
6.1.2
6.1.4
6.1.6
6.1.8
Other
Continuous-Windows
continuous
radare2-windows-nightly
termux
wip
release-5.*
release-5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81879.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "337278525430429154756118529790738502431",
            "length":  994
        },
        "id":  "CVE-2026-81879-0ddb2c73",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(load_fields)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "124174577765083776651989505225247187769",
                "95440894414143185553672211116277899623",
                "48729590592558948320753444766388741447",
                "273291845083423352872756672669231780508",
                "90478996456423134759030744467101155043",
                "126272444866225136615144496754567225682",
                "298268721127206854456638671083568515752",
                "157002099875924840484720899789365143007",
                "119859888771645232423853910942863963095",
                "18740488846885105248095094502656575764",
                "233461550439934206145738418106863639107",
                "101659993840555633208628900882044694606",
                "21333327948760150092983885537066956594",
                "218965122445619900918165089963977254712",
                "156323494768217709661375804071095562348",
                "187176728823239358559060022725086071474",
                "292249233455512192083673084530849885656",
                "141507336062500339976277622655662147227",
                "269934554654166838123648838336687348817",
                "43811442612459962958049156209741625139",
                "170639800525742816325203326835034630411",
                "143444101895433777087672802699534947804",
                "266129161201599643702420092032073776405",
                "282388942333363900491194754300013046700",
                "161735626171671270690569343635428059601",
                "52857068537344283862995973618347408195",
                "59354545295927972600748174922371769637",
                "227005379204671975552662450933663638775",
                "102043933621966047910128482107542947392",
                "286307542522688483527639996732412777422",
                "274230382895858098847279317363385278315",
                "115582448219120243998924402082473894420",
                "170537274179853349089695146331991438723",
                "149792995813472871169608954192903445727",
                "21277975057993438660552714667960728120",
                "44984535046540390676335945449544071231",
                "129953173526506473498544532701645838758",
                "286493265653326824746776353717427010335",
                "19758552864717080163119851412949075690",
                "79467410218474005684247183585228756739",
                "79272886325237058682873344715893029138",
                "154772917258320316644482206609950218963",
                "306034391268332666658338786905651832151",
                "55636072053695439020676450918896029433",
                "176525540803047367850310151855157816960",
                "190245715574326287236868696703858095745",
                "331592969939729986595289860514711259461",
                "23526212494716814443893250711246435554",
                "127158244414511940434515437822815000423",
                "286763397667428625345406652630674063667",
                "106931390020402991584169304420638689829",
                "54318613069207710628126326630507586422",
                "314022271188128408742726719362108134717",
                "138268634233628851032280490872495910242",
                "47119268448279252059153631856872926548",
                "76045058777000945308796210996275214658",
                "325268168444151937456171658154653420504",
                "110926755177228333608942560250722301932",
                "285957319976587301887384363228621880765",
                "117885612602158844469674323666311946988",
                "88713468907070077293251597438201472722",
                "5727746644603902196199849851867702232",
                "155909990923052479975972663987537963751",
                "194344017213214425236436159868516496516",
                "273011745133017095688797394173633556450",
                "326025116268938216995884850422482381861",
                "67769021144936525362612616931659170879",
                "104314316041778698526947560888131783192",
                "126585319729327855451670822294452029497",
                "141984403923880373574872975423243991736",
                "199696495481782345456327317451246065012",
                "306690070595740375771604900354770641409",
                "230123018362087712741858433598430613272",
                "335603920573963566590862429071136615218",
                "96640078082195418180233824594680333568",
                "191710970614960531438039204158349773161",
                "25290956389652383069423735132007221634",
                "141984403923880373574872975423243991736",
                "140001950058696359302857779363808590972",
                "329191729294193422072564431033071306507",
                "337569915207043626057179095680204650839",
                "62392204714498915777417640966738947657",
                "140001950058696359302857779363808590972",
                "157792588194005877310273775868373115006",
                "210352425732666232194599038834631592845",
                "247011818036460257058170874119903136206",
                "313775852348397866952486527647672505413",
                "278876875701462323373301034455344856213",
                "5744914459513199741289963247252503493",
                "308690512826840131194059854329205044146",
                "127351948179285352528918573806060641200",
                "228766336654889450868357088313288240442",
                "72643796997599220061981725350274686380",
                "210352425732666232194599038834631592845",
                "168868454675605151177937447814793075444",
                "315647006072873396800003723463314030945",
                "280092238876339986930496534339959485463",
                "326953748613755137200235580811657439254",
                "101922261858581407788001634244206694822",
                "103334523883034234513498222163232069590",
                "303633351499677299090305946194785847330",
                "4904039697091317119585967481054782553",
                "151831515263020565242506748092876304405",
                "219314066991830966499555463763481277951",
                "231077974408925339090373079830155657400",
                "65105027536747796755252886414615283783",
                "5490047290617328257426670018972126336",
                "317060191535775121047711029884388309427",
                "91948011184129788524180894932605528654",
                "77545731284871891003370154409510927123",
                "217223153315053734643757306633116019662",
                "240886914971883114251458894418452427524",
                "57422751031510058877175078098636520950",
                "313964016486081989141632566696629987285",
                "268080109383986988453423798665809526627",
                "235625198869828527858859768678917012333",
                "171222947182120856948274237031756735685",
                "263209206078779259554753910785558070091",
                "162365351735472098670514034981276919205",
                "306156318953433833565518924789417904937",
                "133305603342606815393345419492277281124",
                "159789066216559503530095427321086305648",
                "265332190235994543636437073496839410946",
                "81721318047562441125850536029784028220",
                "270417942645699903600415292718791588552",
                "158615140763785942068348790230616539348",
                "102902323242108399619998494772392228196",
                "102441924420318254769080255533779275102",
                "279415591618592995062837443765052456475",
                "253282782257776047524897011275881280489",
                "141984403923880373574872975423243991736",
                "68189617227120076208203597834545846873",
                "270123435081196518634458475120344565928",
                "330975768678725262064561404773798409249",
                "320781136859481112676703636897783619068",
                "53824019563490488752337033591838657234",
                "307154869440581095446111812227127799629",
                "143784122687254029174782185054150327037",
                "36795977106427474913410299066065899948",
                "305717450839289539842445622390409852048",
                "311724385290938959079175709621362765541",
                "236984909457136913671967817254549975233",
                "56696023885753522834374621716719226535",
                "233817496235475002730790419923497379135",
                "310882109565580586336720931860510968088",
                "184459225468748213630233656785021696646",
                "183141072776195158760195404170228583830",
                "58675115816967553644032640169201768823",
                "310988836070227977316860413444330406207",
                "54994017702647476696677194498522470002"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-81879-21733336",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "63690867793402007507994864596390323961",
            "length":  424
        },
        "id":  "CVE-2026-81879-2237ac5c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(get_boffset)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "58211027783212075133768386169638483362",
            "length":  1264
        },
        "id":  "CVE-2026-81879-27051c20",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "load_sections_from_phdr"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "136816769691360011899768742070999148403",
            "length":  603
        },
        "id":  "CVE-2026-81879-2b67b6e3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(get_phnum)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "630428141744805458979366278747439120",
            "length":  477
        },
        "id":  "CVE-2026-81879-2fb8869a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(get_baddr)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "187007983492425411700179461257109215873",
            "length":  814
        },
        "id":  "CVE-2026-81879-32521359",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(intrp)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "82483444809835955604300178317052848058",
            "length":  1819
        },
        "id":  "CVE-2026-81879-39c2f7d6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "init_phdr"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "285495788494936090396934176315910073669",
            "length":  2286
        },
        "id":  "CVE-2026-81879-4e604a6c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(get_bits)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "331647253064541145594903586035739898074",
            "length":  632
        },
        "id":  "CVE-2026-81879-5379b06e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(compiler)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "338791419017265827089898323579508470205",
            "length":  1695
        },
        "id":  "CVE-2026-81879-5b583e43",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "load_symbols_from_phdr"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "11297980649522669076614867204827598813",
            "length":  1289
        },
        "id":  "CVE-2026-81879-5f114708",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "init_dynamic_section"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "179344963405098709739843217274887350787",
            "length":  753
        },
        "id":  "CVE-2026-81879-64de5d89",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(v2p)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "18427275995665766591944149307962182298",
            "length":  66
        },
        "id":  "CVE-2026-81879-7975ed22",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "_process_verneed_state"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "135597603671636316985713001761208439239",
            "length":  377
        },
        "id":  "CVE-2026-81879-7aa2c491",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "get_dynamic_segment"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "122821168724034741819996045066302888069",
            "length":  2750
        },
        "id":  "CVE-2026-81879-82493ffd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "init_shdr"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "186903856376506656103231864283101457890",
            "length":  706
        },
        "id":  "CVE-2026-81879-85ac139a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(get_maps)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "285213227163360647594328111149744587870",
            "length":  1181
        },
        "id":  "CVE-2026-81879-8869bd84",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(grab_regstate)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "224710570020563099187159257679500527429",
            "length":  1812
        },
        "id":  "CVE-2026-81879-8ff62146",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "get_nt_file_maps"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "179191764345791972965372612403288975729",
            "length":  291
        },
        "id":  "CVE-2026-81879-9779a18a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(is_static)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "142232550857731167154592903126516519363",
            "length":  253
        },
        "id":  "CVE-2026-81879-b203fc39",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "has_interp_program_header"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "109322329070451246441293627980986459978",
            "length":  876
        },
        "id":  "CVE-2026-81879-bf3be1b3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(p2v)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "166199345055151912197788829608660952374",
            "length":  551
        },
        "id":  "CVE-2026-81879-ef79de22",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "(has_relro)"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "66341970460949271968053103984879034314",
            "length":  290
        },
        "id":  "CVE-2026-81879-f0b8db9b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e",
        "target":  {
            "file":  "libr/bin/format/elf/elf.c",
            "function":  "compute_has_nx"
        }
    }
]
vanir_signatures_modified 
"2026-09-25T08:24:10Z"