radare2 CVE-2026-81879

Requires an analyst to locally open or process an attacker-supplied ELF file with radare2/rabin2 (AV:L, UI:R) - there is no remote or network-triggerable path. The malicious file must specifically set e_phnum = 0xffff (the PN_XNUM extended-count sentinel) while the real program-header count resolved from shdr[0].sh_info is much smaller, so that consumers iterating on the stale e_phnum value read beyond the allocated program-header array. No authentication or special configuration is needed on the victim side, but exploitation is gated entirely by the analyst choosing to analyze an untrusted binary; affected versions are radare2 prior to 6.2.0.

This is a genuine but low-priority defect. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 MEDIUM) is internally consistent with the description: exploitation requires an analyst to locally open or process a crafted ELF file (AV:L, UI:R), and the only demonstrated impact is a heap out-of-bounds read causing process termination (C:N/I:N/A:H - availability-only DoS). No EPSS score, no CISA KEV listing, and no public exploit code are provided, so real-world exploitation is 'no public exploit identified at time of analysis'. There is a signal conflict in the metadata rather than in the CVSS: the input Tags include 'RCE' and 'Information Disclosure', but the CVE description explicitly states that 'memory disclosure and code execution have not been demonstrated' - those tags overstate impact and should be disregarded. The realistic risk is a crash/DoS of the analyst's radare2 process when triaging an untrusted binary, not a server-side or remotely-triggerable condition. High-CVSS optics do not apply here; this is a modest local DoS in analyst tooling with a straightforward patched version available.

An attacker crafts a malicious ELF file whose header declares e_phnum = 0xffff (the PN_XNUM sentinel) while shdr[0].sh_info resolves to a much smaller real program-header count, then distributes it (e.g. malware sample, CTF binary, email attachment). When an analyst opens or analyzes the file with radare2/rabin2, several ELF consumers iterate up to 65535 entries against a smaller allocated program-header array, causing a heap out-of-bounds read and terminating the process. No public exploit code is identified, and impact is limited to denial of service - code execution and memory disclosure were not demonstrated.