Zetlyn
GitHubGet started

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser wa…

cve CVE-2026-81885 1 source, 1 claim · Watch

NVD writes:
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption… the claim
Severity
MEDIUM NVD
CVSS
5.5 NVD
Vendor
radareorg NVD
Product
radare2 NVD
CWE
CWE-770, CWE-835 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2026-09-22first spoke of it: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.NVD

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.

What it is to other things

affectsradare/radare2
NVD
made_byradare
NVD

In words only, so not counted until a person confirms one:

made_byradareorg
NVD says “radareorg”
affectsradareorg/radare2
NVD says “radareorg · radare2”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCno
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD5.5
receipt
Source
NVD
Its words
5.5
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-09-29 09:39 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
receipt
Source
NVD
Its words
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-770, CWE-835
receipt
Source
NVD
Its words
CWE-770, CWE-835
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCWE-770, CWE-835
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDpoc
A public proof of concept exists, or exploitation is trivial.
receipt
Source
NVD
Its words
poc
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCpoc
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDradare2
receipt
Source
NVD
Its words
radare2
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCradare2
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDMEDIUM
From 4.0 to 6.9.
receipt
Source
NVD
Its words
MEDIUM
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCMEDIUM
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
medium
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:39 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCpartial
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDradareorg
receipt
Source
NVD
Its words
radareorg
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCradareorg
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "radare2",
            "vendor": "radareorg",
            "versions": [
              {
                "status": "affected",
                "version": "< 6.2.0"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "89E67591-1BCF-49F0-B047-71FCB5524CDB",
                "versionEndExcluding": "6.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0."
      }
    ],
    "id": "CVE-2026-81885",
    "lastModified": "2026-09-28T13:27:09.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-81885",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-25T23:30:34.248880Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T16:18:03.500",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/commit/93d794caa7c2f08413106255d49546e544c1f9f0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/radareorg/radare2/pull/26192"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Issue Tracking",
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://github.com/radareorg/radare2/issues/26225"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          },
          {
            "lang": "en",
            "value": "CWE-835"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.
zetlyn/cve-nvd · 2026-09-22
automatable no cvss 5.5 cvss_vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H cwe CWE-770, CWE-835 exploitation poc product radare2 severity MEDIUM status Analyzed technical_impact partial vendor radareorg source