radare2 EUVD-2026-84503

Exploitation requires an analyst to open or inspect a crafted CPython bytecode .pyc file through radare2 (r2) or rabin2 on a local system - the vulnerable code path is the pyc marshal parser in libr/bin/format/pyc/marshal.c. The specific trigger is a marshal string-length field of 0xffffffff, which wraps the size-plus-one heap allocation to zero. Limiting factors: attack is LOCAL (AV:L), requires user interaction (UI:R) to load the attacker-supplied file, no authentication is involved, and impact is limited to heap corruption/denial of service against the analysis tool itself; arbitrary code execution is not demonstrated. Only environments where untrusted .pyc samples are opened in radare2/rabin2 (malware analysis, CTF, RE workflows) are realistically at risk.

This is a genuinely low-priority issue despite the alarmist 'RCE' tag. The CVSS 3.1 base score of 5.5 (MEDIUM) is driven entirely by the AV:L/UI:R/A:H combination - the attack vector is LOCAL and requires user interaction: an analyst must actively open or inspect a crafted .pyc file through r2 or rabin2. There is no network exposure, no autonomous exploitation, and the confirmed impact is availability-only (C:N/I:N/A:H). The description explicitly states arbitrary code execution is theoretically possible but has NOT been demonstrated, so the memory-corruption-to-RCE path is speculative. No EPSS score, no CISA KEV listing, and no public POC were provided - this is a vendor/researcher-reported parser hardening fix, not an actively-exploited threat. The signals are internally consistent (local vector matches the file-parsing trigger); no conflicts to flag. Real-world risk is confined to reverse engineers who load untrusted .pyc samples, and even then the worst reliably-achievable outcome is a crash of the analysis tool.

An attacker distributes a malicious Python .pyc sample (e.g. as part of a malware package under analysis) whose CPython marshal string-length field is set to 0xffffffff. When a reverse engineer opens or inspects it with r2 or rabin2, the length-plus-one allocation wraps to zero and the byte reader writes attacker-controlled data past the undersized heap buffer, corrupting the heap and crashing (or potentially, though unproven, executing code within) the analyst's tool. No public exploit code was identified at time of analysis; exploitation requires the analyst to open the file locally (UI:R).