radare2 CVE-2026-81881

Exploitation requires the victim to open and analyze an attacker-crafted Mach-O file in radare2 prior to 6.2.0, and the file must contain Swift type or class metadata with a relative field pointer lower than the field-metadata section base (triggering the negative logical index). Limiting factors are significant: the attack vector is local (the malicious file must reach the analyst's machine) and requires user interaction (UI:R - the analyst must actively load/parse the file); no remote or unauthenticated path exists. The Swift-metadata parsing code path (mach0_classes.c parse_type) must be reached, so the target must be a Mach-O binary containing Swift metadata. Impact is confined to a 4-byte out-of-bounds read causing crash or incorrect parsing.

This is a genuinely low-priority issue and the low CVSS (3.3) is well-justified rather than inflated. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L makes the constraints explicit: exploitation is LOCAL (AV:L) and requires user interaction (UI:R) - a victim must load/analyze a crafted Mach-O file in radare2. The only impact is availability-low (A:L) with no confidentiality or integrity impact (C:N/I:N), consistent with the description's explicit statement that 'no attacker-observable memory disclosure has been demonstrated.' The bug is a 4-byte out-of-bounds READ immediately before the field-metadata buffer (CWE-125), producing at most incorrect metadata parsing or a process crash. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the input - status is no public exploit identified at time of analysis. There is a real signal conflict to flag: the input Tags include 'Information Disclosure,' but both the description ('no attacker-observable memory disclosure has been demonstrated') and the CVSS C:N contradict any confidentiality impact - that tag is mislabeled. Bottom line: a real-but-minor robustness/DoS bug in a file parser, not an exploitation priority.

An attacker distributes a maliciously crafted Mach-O binary (e.g., via a malware sample, CTF challenge, or supply-chain artifact) whose Swift type/class metadata contains a relative field pointer lower than the field-metadata section base. When a reverse engineer opens and analyzes the file in a vulnerable radare2 (<6.2.0), the negative logical index causes a 4-byte read just before the allocated buffer, corrupting metadata processing or crashing the analysis process. No public exploit code is identified, and the demonstrated impact is limited to a crash - no memory disclosure or code execution has been shown.