radare2 CVE-2026-81880

Exploitation requires an analyst to load or auto-analyze an attacker-supplied crafted Apple Preferred Executable Format (PEF) file in radare2 prior to version 6.2.0. The trigger is normal binary-format auto-detection - no explicit command beyond opening the file is needed (distinguishing it from sibling pFB/pFBj-gated radare2 bugs). Limiting factors: the attack is local (AV:L), requires user interaction to open/process the malicious file (UI:R), needs no authentication or privileges (PR:N), and yields only denial of service (CPU/time exhaustion) with no confidentiality, integrity, or code-execution impact. There is no network-reachable attack surface.

This is a genuine but low-priority denial-of-service issue whose signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) correctly reflects a local, low-complexity, availability-only flaw that requires user interaction - an analyst must open or auto-analyze a crafted Apple PEF file in radare2. There is no confidentiality or integrity impact; the sole consequence is CPU exhaustion (up to 268,435,456 relocation-section iterations plus repeated buffer operations past end-of-file), causing hangs or prolonged processing rather than crash or code execution. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The vendor-fixed root cause is confirmed by the GHSA advisory and the commit diff, which adds bounds checks on offsets, target counts, and overflow-checked address arithmetic. The signals do not conflict: this is a low-real-risk, high-noise-value bug - a robustness/hardening fix for a reverse-engineering tool, not an urgent enterprise threat. The only nuance worth verifying is that AV:L is appropriate because triggering requires locally supplied file input; there is no network-reachable path in the described scenario.

An attacker crafts a small malformed Apple PEF binary with an inflated relocSecCount field and delivers it to a reverse engineer (e.g., as a suspicious sample or malware artifact). When the analyst opens it in radare2 - or auto-detection alone identifies it as PEF during loading - the loader loops through up to ~268 million relocation-section iterations, pinning CPU and hanging the analysis session. No public exploit code is identified, but the trigger is trivial to construct given the described unbounded field.