CVE-2026-81878: radare2 CPython Parser DoS Vulnerability

CVE-2026-81878 Overview

CVE-2026-81878 is a heap buffer overflow in radare2, a UNIX-like reverse engineering framework and command-line toolset. The vulnerability affects the CPython bytecode .pyc marshal parser in versions prior to 6.2.0. The parser accepts a 32-bit string length without validating that the value overflows the size-plus-one allocation. An analyst who opens or inspects a crafted .pyc file with r2 or rabin2 triggers the flaw. The issue is classified as an integer overflow leading to heap memory corruption [CWE-190].

Critical Impact

Parsing a malicious .pyc file causes heap memory corruption and denial of service. Arbitrary code execution is theoretically possible but has not been demonstrated.

Affected Products

• radare2 versions prior to 6.2.0
• rabin2 binary information extractor (bundled with radare2)
• Downstream tools embedding the radare2 libr/bin Python loader

Discovery Timeline

• 2026-09-22 - CVE-2026-81878 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-81878

Vulnerability Analysis

The defect resides in the get_bytes helper inside libr/bin/format/pyc/marshal.c. This function reads a variable-length byte string from a .pyc marshal stream. It receives a ut32 size value taken directly from the file and passes size + 1 to the R_NEWS0 allocator. When size equals 0xffffffff, the addition wraps to zero. The allocator returns a zero-length buffer, and the subsequent r_buf_read call writes attacker-controlled bytes past the heap boundary.

The outcome is a linear heap write overflow driven entirely by file content. Because radare2 and rabin2 are frequently used to triage untrusted binaries, malware samples, and CTF artifacts, the parser is regularly exposed to hostile input. Successful exploitation corrupts adjacent heap metadata and application data, producing a crash at minimum.

Root Cause

The root cause is a missing upper-bound check on the attacker-controlled size parameter before the size + 1 allocation arithmetic. The 32-bit width of the length field combined with unchecked addition permits an integer overflow [CWE-190] that defeats the allocator's implicit size assumption.

Attack Vector

Exploitation requires a local user to open or inspect a crafted .pyc file through r2 or rabin2. No authentication is required at the tool level, but user interaction is needed to invoke the parser against the malicious file. Delivery vectors include shared malware repositories, forensic disk images, or supply-chain artifacts staged for reverse engineering.

// Security patch in libr/bin/format/pyc/marshal.c
// Rejects oversized length values before the size+1 allocation
static ut8 *get_bytes(RBuffer *buffer, ut32 size) {
	if (size >= ST32_MAX) {
		return NULL;
	}
	ut8 *ret = R_NEWS0 (ut8, size + 1);
	if (ret && r_buf_read (buffer, ret, size) < size) {
		free (ret);

Source: radare2 commit 6727454b

Detection Methods for CVE-2026-81878

Indicators of Compromise

• .pyc files containing a marshal string length field of 0xffffffff or other values approaching ST32_MAX
• Unexpected crashes, SIGSEGV, or heap corruption warnings from r2 or rabin2 processes when opening .pyc artifacts
• Core dumps referencing get_bytes or marshal.c in the radare2 call stack

Detection Strategies

• Scan reverse-engineering workstations for radare2 builds older than 6.2.0 using package inventory tooling
• Statically inspect .pyc samples for marshal string headers that declare implausible lengths before analysis
• Run radare2 against untrusted .pyc files inside an instrumented sandbox with AddressSanitizer to surface out-of-bounds writes

Monitoring Recommendations

• Alert on abnormal process termination of r2 or rabin2 on analyst endpoints and forensic workstations
• Log command-line invocations of rabin2 targeting files with the .pyc extension for post-incident review
• Monitor package management events for the radare2 upgrade to version 6.2.0 across managed hosts

How to Mitigate CVE-2026-81878

Immediate Actions Required

• Upgrade all radare2 installations to version 6.2.0 or later, which contains the get_bytes bounds check
• Restrict use of vulnerable r2 and rabin2 binaries to isolated analysis virtual machines until patched
• Treat all third-party .pyc files as untrusted input and stage them in disposable sandboxes

Patch Information

The fix is included in radare2 release 6.2.0. The corrective commit adds an ST32_MAX guard in get_bytes before allocation. See the GitHub Security Advisory GHSA-9phv-v2w8-56j3 and the associated pull request #26177 for full technical context.

Workarounds

• Avoid invoking r2 or rabin2 on .pyc files sourced from untrusted origins until the upgrade is deployed
• Run reverse-engineering sessions inside non-privileged accounts and ephemeral containers to contain heap corruption impact
• Pre-filter incoming .pyc samples with a custom parser that rejects marshal string lengths at or above ST32_MAX

# Verify installed radare2 version and upgrade
r2 -v
# Expected: radare2 6.2.0 or later

# Example upgrade paths
git clone https://github.com/radareorg/radare2 && cd radare2 && git checkout 6.2.0 && sys/install.sh
# or via package manager once 6.2.0 is available
# apt-get update && apt-get install --only-upgrade radare2