CVE-2026-81879 Overview
CVE-2026-81879 is an out-of-bounds read vulnerability [CWE-125] in radare2, a UNIX-like reverse engineering framework and command-line toolset. The flaw affects versions prior to 6.2.0 in the Executable and Linkable Format (ELF) parser. The parser allocates the program-header array using the resolved PN_XNUM count, while several consumers continue to iterate using the original e_phnum value of 0xffff. Processing a crafted ELF file triggers the mismatch, leading to a heap out-of-bounds read and process termination. Memory disclosure and code execution have not been demonstrated. The issue is fixed in radare2 version 6.2.0.
Critical Impact
Analysts opening an attacker-supplied ELF file in a vulnerable radare2 build can experience a heap out-of-bounds read that terminates the process, disrupting reverse engineering workflows.
Affected Products
- radare2 versions prior to 6.2.0
- radare2 ELF program-header parser (PN_XNUM handling)
- Downstream tooling embedding vulnerable radare2 ELF loaders
Discovery Timeline
- 2026-09-22 - CVE-2026-81879 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-81879
Vulnerability Analysis
The vulnerability resides in radare2's ELF loader when it handles the PN_XNUM extension. The ELF specification defines PN_XNUM (0xffff) as a sentinel indicating that the actual program-header count is stored in shdr[0].sh_info. The radare2 parser correctly allocates the program-header array using the resolved count from sh_info. Several consumers of that array, however, still iterate using the raw e_phnum field, which remains 0xffff. When the resolved count is much smaller than 65535, iteration extends past the allocated buffer, producing a heap out-of-bounds read [CWE-125]. The process reads adjacent heap memory and typically crashes, resulting in denial of service.
Root Cause
The root cause is inconsistent use of two related fields. Allocation logic uses the resolved program-header count, while iteration logic relies on the original header value e_phnum = 0xffff. This state divergence between allocator and consumer creates the bounds mismatch. The fix in commit 9449b07579c19b6b187c1a0918fbec2cef1a036e aligns iteration with the resolved count.
Attack Vector
Exploitation requires local user interaction. An attacker crafts an ELF file with e_phnum set to 0xffff and a smaller resolved program-header count encoded in shdr[0].sh_info. When a user opens the file in a vulnerable radare2 build, iteration overreads the program-header array on the heap. The result is a crash of the radare2 process. See the GitHub Security Advisory GHSA-jqfq-hvcp-xh4p and the GitHub Issue Discussion for technical details.
Detection Methods for CVE-2026-81879
Indicators of Compromise
- Unexpected crashes or aborts in radare2 (r2) processes when opening ELF samples
- ELF samples with e_phnum equal to 0xffff combined with a smaller shdr[0].sh_info program-header count
- Heap-related fault signatures such as SIGSEGV or AddressSanitizer heap-buffer-overflow-read reports referencing ELF parsing paths
Detection Strategies
- Scan ELF triage corpora for headers where e_phnum == 0xffff and sh_info < 0xffff to flag candidate trigger files
- Monitor endpoints used by malware analysts for repeated radare2 process terminations tied to specific ELF inputs
- Run vulnerable builds under AddressSanitizer or Valgrind to surface out-of-bounds reads in the ELF loader
Monitoring Recommendations
- Log invocations of radare2, r2, and rabin2 along with input file hashes on analyst workstations
- Alert on abnormal termination signals from reverse engineering tooling processing untrusted samples
- Track deployed radare2 versions across analyst systems and flag any build older than 6.2.0
How to Mitigate CVE-2026-81879
Immediate Actions Required
- Upgrade radare2 to version 6.2.0 or later on all analyst workstations and build systems
- Inventory container images, packages, and CI pipelines that bundle radare2 and rebuild them against the fixed release
- Restrict processing of untrusted ELF samples to isolated sandboxes or virtual machines until patching completes
Patch Information
The fix is available in radare2 release v6.2.0. The corrective change is documented in the GitHub Commit Details and the associated GitHub Pull Request Review. Consumers of the program-header array are aligned to iterate using the resolved PN_XNUM count rather than the raw e_phnum value.
Workarounds
- Avoid opening untrusted ELF files in radare2 versions prior to 6.2.0
- Pre-screen input ELF samples and reject files where e_phnum == 0xffff but the resolved program-header count is smaller
- Execute radare2 inside a container or non-privileged sandbox to contain crashes and limit host impact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
