Radareorg Radare2 vulnerabilities

CVE-2026-14786 [MEDIUM] CWE-189 CVE-2026-14786: A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_st A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulation results in integer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 11ac224c0

CVE-2026-81885 [MEDIUM] CWE-770 CVE-2026-81885: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocat

CVE-2026-81880 [MEDIUM] CWE-400 CVE-2026-81880: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal bin

CVE-2026-81886 [MEDIUM] CWE-770 CVE-2026-81886: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small c

CVE-2026-81881 [MEDIUM] CWE-125 CVE-2026-81881: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift typ

CVE-2026-81883 [LOW] CWE-125 CVE-2026-81883: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by

CVE-2026-81884 [LOW] CWE-125 CVE-2026-81884: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-def