CVE-2026-81880
- Source
- https://cve.org/CVERecord?id=CVE-2026-81880
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81880.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-81880
- Aliases
-
- GHSA-fg6f-rj8g-25pq
- Downstream
- Published
- 2026-09-22T15:09:48Z
- Modified
- 2026-09-24T08:34:27Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- radare2: Uncontrolled resource consumption in radare2 PEF loader
- Details
-
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400", "CWE-834" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81880.json" }- References
-
- https://github.com/radareorg/radare2/releases/tag/6.2.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81880.json
- https://github.com/radareorg/radare2/security/advisories/GHSA-fg6f-rj8g-25pq
- https://nvd.nist.gov/vuln/detail/CVE-2026-81880
- https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac
Affected packages
Git / github.com/radareorg/radare2
Affected versions
0.*
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.4-termux4
0.10.5
0.10.6
0.8.6
0.8.8
0.9
0.9.2
0.9.4
0.9.6
0.9.7
0.9.8
0.9.8-rc1
0.9.8-rc2
0.9.8-rc3
0.9.8-rc4
0.9.9
1.*
1.0
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.0-git
1.3.0
1.3.0-git
1.4.0
1.5.0
1.6.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.4.0
2.5.0
2.6.0
2.6.9
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.3.1
4.4.0
4.5.1
5.*
5.0.0
5.1.0
5.1.1
5.2.0
5.2.1
5.3.0
5.3.1
5.4.0
5.4.0-git
5.4.2
5.5.0
5.5.2
5.5.4
5.6.0
5.6.2
5.6.4
5.6.6
5.6.8
5.7.0
5.7.2
5.7.4
5.7.6
5.7.8
5.8.0
5.8.2
5.8.4
5.8.6
5.8.8
5.9.0
5.9.2
5.9.4
5.9.6
5.9.8
6.*
6.0.0
6.0.2
6.0.4
6.0.6
6.0.7
6.0.8
6.1.0
6.1.2
6.1.4
6.1.6
6.1.8
Other
Continuous-Windows
continuous
radare2-windows-nightly
termux
wip
release-5.*
release-5.0.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81880.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "324112514328379812876858145547156779990",
"length": 330
},
"id": "CVE-2026-81880-1ef91f2f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac",
"target": {
"file": "libr/bin/p/bin_pef.c",
"function": "push_reloc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325008253209019321562908375210784562208",
"length": 909
},
"id": "CVE-2026-81880-4bc56653",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac",
"target": {
"file": "libr/bin/p/bin_pef.c",
"function": "relocs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "198235475469693682278649310242906958286",
"length": 5499
},
"id": "CVE-2026-81880-7cd1dfe7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac",
"target": {
"file": "libr/bin/p/bin_pef.c",
"function": "do_reloc_bytecode"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"295024283854975729068861154256108496062",
"118530727822571747824496746975763556313",
"181764032421134939457573354001429368821",
"252586169577554057969656638143329325381",
"198557988508437039033952057533159644016",
"159557884124414036674777592752393811336",
"97087241326709152977535536903107032918",
"499997325271785537170132572058393511",
"195973045939795186100821600119001771111",
"242708720034175570700027807789867016348",
"246084198828441669154809318777687574369",
"137949818590376224950587428758667517643",
"320070420474875768019483169664398673669",
"93053217742947102600081664771335703509",
"314105465468789538014811518356682349691",
"223790213939518795004437577933268004097",
"222701913735175659297180341700679115997",
"290618930098694384978485156278193013846",
"168140562148196299143498528195027721644",
"251277664695399752843386802630630117628",
"180440580447500525481110641031852646924",
"122858028210838507742587266960762711149",
"191958063970281646724671922160975482946",
"173582685745633503429583277600558661448",
"11807089266473370046963962918998374628",
"313555800472945512957415656314894242570",
"267777422944480727879036717030158004467",
"332265217239755314289414025630449820489",
"84348022337650713868236863471269494370",
"258690078235184171081988509457669163324",
"287492880458305824141233116607655351915",
"55898120080497119074677367599100418129",
"139976178931277307445598535099249587259",
"89769115125429623322489588186093733643",
"130666509220497921124574421166022866904",
"91605058596903994911214761049083646061",
"127074720309862963404733545481182928820",
"248926181905291592679611257726526382908",
"179789621232266199658133609032923821543",
"144092701450877588022848953619497314918",
"62228246663424755138278699020238368440",
"135856019527725802496364817300399830771",
"65179065327689989176893525501414321982",
"102852102463403124827393134350629755324",
"325256241300028292112347964882546977273",
"153234798899187957685791015973965880106",
"112208605997552592344313745519556404870",
"53420003712401932139869345527669213718",
"50502540731667061505262841943943424437",
"125521736614492640539733441703804376978",
"294422968400645300827699768931447029741",
"167310236502359356382544172985800613546",
"219333873894400869034607351861418642355",
"112208605997552592344313745519556404870",
"80701070888086942652833613883286507649",
"144594721971901169383124619324587888118",
"91943690922299410438173389900462247977",
"316748273628575584381990634952124464905",
"61374609559027626309743636359815918916",
"186385503035217827315731069183324710784",
"276948868412673583560759971636397108395",
"153234798899187957685791015973965880106",
"112208605997552592344313745519556404870",
"74148619934139565277313415629661358233",
"102013364757633696093404201516276031293",
"306847703091388681571580132696739841786",
"122024940121838939501326134211591357570",
"53981253747782022278153512018909402028",
"318478038898797458890162908538545458608",
"167310236502359356382544172985800613546",
"219333873894400869034607351861418642355",
"149062811268451695303625859729597687239",
"179842584432419891170380954191617702131",
"276301824563653492633713166490196733224",
"87147481204485887403178451247532112986",
"195986178190578070756168449708447307035",
"201408612090884698917811606343077241877",
"161028991753283727434041829635585798540",
"254608686257735129497741701094904115195",
"3543587657184217506949463670021509948",
"186580604041231803303756627639641887789",
"22484219743705685401714395447907900905",
"167310236502359356382544172985800613546",
"219333873894400869034607351861418642355",
"149062811268451695303625859729597687239",
"179842584432419891170380954191617702131",
"276301824563653492633713166490196733224",
"153234798899187957685791015973965880106",
"112208605997552592344313745519556404870",
"62352206745268677026720870415574734884",
"68741078342927732902075405512998966148",
"199626515675116837473464963769138775058",
"97357394301632542174482405464733975756",
"286231844782411486128604911461495971458",
"253939471556440812292892445697333939851",
"276948868412673583560759971636397108395",
"87147481204485887403178451247532112986",
"195986178190578070756168449708447307035",
"163562266933720996334538352116062679022",
"2347348399656172272337396277070430709",
"118293933638145818927760933729486186944",
"306238663577143539163765241070642170414",
"79188956058266608032960094519358470973",
"266262640147626978644148579215683944945",
"188857253460777542175703614649380536822",
"144430168690920422788616655454841179495",
"185117373599916025283387554515296372397",
"298783533225339864379829217731536506819",
"14402964300259809567034138342503026434",
"131640376563780548607541091406188289069",
"222506813436447733246995798180444982685",
"278022459391001132493248146214156481954",
"317938644513043703294927918938223927788",
"325850488736166210459428650321870096828",
"79169817117197926912788699128539648191",
"188987741047213651759332047082206391664",
"66171091937838070008632861587974907769",
"280254009194718928113058887253972580213",
"8325603121220295334624780498412447064",
"335332346401937436982026199004550755540",
"207115086246202998715555709964549762753",
"205896725781779637037531107398735703780",
"314951497869368099442807477096119109244",
"156742796987492760485585558916652475528",
"59236943514726848741714177168295532394",
"80278163392128152615859660863601045899",
"146475884942254507369104492986646882876",
"125391834620643271713797115781669442032",
"305339344850163069241261870791448758966",
"230081386385834779835576569794938693643",
"44554634120778605218523776449455502213",
"118147648977255053210614373680291524138",
"109013461899453134665309381112139146142",
"188987741047213651759332047082206391664",
"66171091937838070008632861587974907769",
"93919308162383351431912981005127573767",
"44844392792110290231285401049644783500",
"340188788655914158026413432235754123863",
"200861134599920988617005698356188703524",
"325635071449161997247271580183797799458",
"314951497869368099442807477096119109244",
"192912249132733112105611759787579843250",
"134851003568602428695795926812185008929",
"256851805169875678050356070051000160917",
"174743532934724051410375363993002926051",
"264687513142278438745035988388021388257",
"306017483041109663126793878314691133648",
"285148819359231991271331449158685962179",
"163462752560838113240964339847366306828",
"31439885329515436167539358327068076963",
"148579269379752979791761307009586610265",
"304269736332620024155249428029887148496",
"82497754991073257303242291575013312307",
"328971764705040125803619207722951282687",
"224425781522203433478495554031858278224",
"238172275395186710830592272959079888604",
"85203513480809052686329055867592470403",
"46470892017927727878143345049173652076",
"82375609078443655918210895607117780119",
"110932835773148568436283279167794167495",
"42676922814883707370910522208698913343",
"139387894493722684693064260557091611961",
"215457925227913259625192596574916567708",
"37001473295486461500940889465650009150",
"339367463434089196421700004981454139318",
"136559258239137831777834997678566413824",
"307191249391876248521830931035321599334",
"127558089978267017195818685931442657680",
"297161758614696274530016716463766152187",
"209877551013513585781356839331974815934",
"305113406381066713277143728683914631610",
"144213584228273856210179398759843024453",
"97330425220071696869412378300698934987",
"146083724315283301826465817252727762447",
"333415253611251523590283583194485500053",
"99910381664654754130101592441952755154",
"181331925739746980951040986895202838066",
"323219135717853216890783088159375398546",
"166635315977997931739716670566584313885",
"276313468301456185157143953660621571216",
"128602623895142489431154930913351700371",
"125165856266168487392173744563080721718",
"322752663659582775960876152637279609157",
"296577113440208184658763727482864194292",
"49465795727263074868819902739857000308",
"15528950815463967067095530421791788388",
"178118675155973304008354934392386820469",
"79275921926772769795950885472002120887",
"26012415431000999357398528967250431773",
"89081900317109180208416498101071662987",
"103391399090134443973685571447887388644",
"197484296465244551978145805299566186525",
"127514947895825272333786879779768368613",
"113644458195000464891652684643958533664",
"51116905695514383212504869991821346175",
"260070950116204427969555201072703438069",
"283376125867939126444214775945246123712",
"24720727229375218160502622657419430565",
"63023319149774050960125992398873200987",
"247372444007269458036090414453414845435",
"62097463567307906493256088113365029899",
"138377151207266812609006725938624814649",
"96795876107268074988380993965144692324",
"69580136611683150414315902815586149308",
"42622108474508039079308773490358951310"
],
"threshold": 0.9
},
"id": "CVE-2026-81880-cc99aaab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac",
"target": {
"file": "libr/bin/p/bin_pef.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313449569979024027267902073144209190524",
"length": 3475
},
"id": "CVE-2026-81880-effc1706",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac",
"target": {
"file": "libr/bin/p/bin_pef.c",
"function": "load"
}
}
]
vanir_signatures_modified
"2026-09-24T08:34:27Z"