---
id: CVE-2026-81879
title: radare2 is a UNIX-like reverse engineering framework and command-line toolset
summary: >-
  radare2 is a UNIX-like reverse engineering framework and command-line toolset.
  Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF
  parser allocated the program-header array using the resolved PN_XNUM count but
  s…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-125
vendor: radare
product: radare2
affected:
  - radare2 < 6.2.0
patched:
  - radare2 6.2.0
published: '2026-09-22'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T16:53:48.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81879'
references:
  - url: >-
      https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e
    label: security-advisories@github.com
  - url: 'https://github.com/radareorg/radare2/issues/26223'
    label: security-advisories@github.com
  - url: 'https://github.com/radareorg/radare2/pull/26178'
    label: security-advisories@github.com
  - url: 'https://github.com/radareorg/radare2/releases/tag/6.2.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/radareorg/radare2/security/advisories/GHSA-jqfq-hvcp-xh4p
    label: security-advisories@github.com
  - url: 'https://github.com/radareorg/radare2/issues/26223'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00207
epssPercentile: 0.09607
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T15:38:19.474912Z'
ingestedAt: '2026-09-22T16:06:00.487Z'
---

## Overview

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.

## Affected

- `radare2 < 6.2.0`

## Remediation

Upgrade past the affected range:

- `radare2 6.2.0`