EUVD-2026-84468Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed Mach-O with bad datasize
-
DeliveryDeliver sample to analyst
-
ExploitAnalyst opens file with bin.verbose enabled
-
ExecutionParser reads beyond heap buffer
-
Impactradare2 process crashes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Mach-O file in radare2 prior to 6.2.0 WITH the non-default bin.verbose option enabled, and the crafted file's LC_DATA_IN_CODE datasize must not be a multiple of data_in_code_entry so the final partial record reads past the buffer. Limiting factors: local attack vector (attacker must deliver a file), required user interaction (analyst must open it), and a non-default configuration toggle that most users do not enable - together making practical exploitation unlikely and impact limited to a process crash. |
| Impact | This is a low-priority issue and the signals are consistent rather than conflicting. The vendor CVSS of 2.5 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately reflects a local, high-complexity, user-interaction-gated heap out-of-bounds READ whose only realistic consequence is a process crash (A:L); the description explicitly states 'no attacker-observable memory disclosure has been demonstrated,' so despite the CWE-125 read primitive there is no confirmed confidentiality impact. AC:H is well-justified because the flaw only triggers under the NON-DEFAULT bin.verbose option AND when datasize is not a multiple of data_in_code_entry. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag conflicts with the description's explicit denial of memory disclosure and should be treated as mislabeled - real impact is availability (crash) of a locally-run analyst tool only. |
| Exploit ScenarioDerived | An attacker distributes a crafted Mach-O binary (e.g., as suspected malware sample) to a reverse engineer who has enabled the non-default bin.verbose option in radare2 prior to 6.2.0. When the analyst opens the file, the LC_DATA_IN_CODE parser reads past the allocated buffer on a final partial record, causing a heap out-of-bounds read and possible crash of the radare2 process. No public exploit code is identified, and no memory disclosure has been demonstrated - impact is limited to denial of the analyst's session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a crafted Mach-O file in radare2 versions prior to 6.2.0 can trigger a heap out-of-bounds read in the LC_DATA_IN_CODE parser, potentially terminating the process. The flaw is only reachable when the non-default bin.verbose option is enabled and the crafted file declares an LC_DATA_IN_CODE datasize that is not a multiple of the data_in_code_entry structure size, causing the parser's final loop iteration to read past the allocated buffer. Impact is limited to a denial-of-service style crash (CVSS 2.5, AV:L/AC:H/PR:N/UI:R, availability-only); no attacker-observable memory disclosure has been demonstrated, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade to radare2 6.2.0 or later, which is the vendor-released patch for this issue and contains both the range validation (fits_in check plus rejection of datasize greater than ST32_MAX) and the corrected loop bound that only processes complete data_in_code_entry records; the fix commit is a73de09fea7516f65c14917d66113316ec7e7d6e and the release is available at https://github.com/radareorg/radare2/releases/tag/6.2.0, with details in advisory GHSA-c2g2-2mc7-3x5w. If upgrading immediately is not possible, the most direct compensating control is to leave bin.verbose disabled (do not set bin.verbose=true via -e or a radare2rc configuration, and avoid analysis scripts that enable it), since the vulnerable code path is only reached when verbose diagnostics are active; the trade-off is the loss of verbose loader output, which some analyst workflows and debugging scripts rely on. As a defense-in-depth measure, avoid opening untrusted or attacker-supplied Mach-O files on systems where radare2 is invoked automatically, and consider running radare2 against untrusted samples inside a sandbox or ephemeral container so that a parser-induced process termination cannot affect other workloads; note that this does not eliminate the crash but confines it. Because the demonstrated impact is limited to a process abort with no memory disclosure, these mitigations are proportionate while patch deployment is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
radare2 is a reverse engineering framework and command-line toolset that parses numerous executable formats, including Apple's Mach-O. Mach-O binaries carry load commands, and LC_DATA_IN_CODE references a table of data_in_code_entry records describing regions of __text that are not instructions. Each record is a fixed-size structure (a 32-bit offset, a 16-bit length, and a 16-bit kind, for 8 bytes total). In the vulnerable code path in libr/bin/format/mach0/mach0.c, the init_items() routine trusted the linker-supplied dataoff and datasize values, read the table into a heap buffer of exactly datasize bytes, and then iterated with a fixed stride of 8 bytes without verifying that datasize was an exact multiple of the entry size. When datasize was not a multiple of 8, the final iteration indexed beyond the allocated buffer, producing a heap out-of-bounds read (CWE-125). The fix (commit a73de09fea7516f65c14917d66113316ec7e7d6e, PR #26193) validates that datasize does not exceed ST32_MAX and that the [dataoff, dataoff+datasize) range fits within the mapped file via fits_in(mo->size, dataoff, datasize), requires r_buf_read_at to return the full expected byte count, and changes the loop bound to j + entry_size <= datasize so only complete records are processed. Because the vulnerability is gated behind the non-default bin.verbose option and only manifests as a read past the buffer that feeds eprintf diagnostics, no data exfiltration path has been shown.
Know when Radare2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Local crafted-file open (AV:L, UI:R), gated by non-default bin.verbose and a non-aligned datasize (AC:H); crash-only with no demonstrated disclosure, so C:N/I:N/A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyz
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Exploit-DB