radare2 EUVD-2026-84471

Exploitation requires a victim to open an attacker-supplied, crafted NE (New Executable) file in radare2 prior to version 6.2.0; the malicious file must contain an in-bounds relocation entry that points back to itself rather than terminating at 0xffff, causing the NE relocation fixup-chain parser to loop without an iteration limit or cycle detection. Limiting factors: this is local-only (AV:L) and requires user interaction (UI:R) - there is no remote or network-triggered path - and impact is confined to denial of service (CPU/memory exhaustion) with no confidentiality or integrity effect. It is patched in 6.2.0.

This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) correctly frames it as a local, user-interaction-gated denial of service with no confidentiality or integrity impact - an attacker cannot reach the vulnerable NE relocation parser remotely; a user must actively open a crafted NE executable in radare2. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: A:H reflects the unbounded CPU/memory consumption (CWE-770), while C:N/I:N/A:H matches a pure resource-exhaustion loop with no memory corruption or code execution. There is no conflict between vector and description - both point to local, victim-triggered DoS. Realistically this is a stability/robustness bug in an analysis tool rather than an attacker-priority target; the main risk is analysts detonating hostile samples in radare2 as part of routine malware triage, which is a plausible but self-limiting scenario. Fix availability (6.2.0) is well-corroborated by the vendor advisory, issue, PR, and commit.

An attacker crafts a malicious NE executable whose in-bounds relocation entry points back to itself instead of terminating at 0xffff, then delivers it to a reverse engineer (e.g., as a suspicious sample for triage). When the analyst opens the file in radare2 prior to 6.2.0, the fixup-chain parser loops indefinitely, allocating a new relocation object on every iteration and consuming CPU and memory until the process hangs or is killed. No public proof-of-concept is referenced, and exploitation requires the victim to open the file locally (AV:L/UI:R).