CVE-2026-81880: radare2 PEF Loader DOS Vulnerability

CVE-2026-81880 Overview

CVE-2026-81880 is a denial-of-service vulnerability in radare2, a UNIX-like reverse engineering framework and command-line toolset. The flaw exists in the Apple Preferred Executable Format (PEF) loader in versions prior to 6.2.0. The loader accepts relocSecCount values without bounding them against the number of sections or complete relocation records present in the input file. A crafted PEF file triggers up to 268,435,456 relocation-section iterations, causing excessive CPU consumption during normal binary auto-detection. The issue is tracked under [CWE-400] (Uncontrolled Resource Consumption) and is fixed in radare2 version 6.2.0.

Critical Impact
Analysts opening a small crafted Apple PEF file with radare2 can experience prolonged processing and CPU exhaustion, disrupting reverse engineering workflows.

Affected Products

radare2 versions prior to 6.2.0
radare2 Apple PEF binary loader component
Tooling and pipelines that invoke radare2 for automated binary triage

Discovery Timeline

2026-09-22 - CVE-2026-81880 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-81880

Vulnerability Analysis

The vulnerability resides in radare2's Apple PEF loader, which parses Apple Preferred Executable Format binaries. The loader reads the relocSecCount field from the input and uses it directly to drive relocation processing loops. Because the value is not validated against the number of sections declared in the file or against the count of complete relocation records available in the buffer, an attacker can specify an arbitrarily large count.

The loader then iterates up to 268,435,456 times, performing repeated buffer operations even after relocation record offsets exceed the end of the file. This produces excessive CPU consumption and prolonged processing time. Exploitation requires that a user open or auto-detect a crafted PEF file, which occurs during routine binary triage in radare2.

Root Cause

The root cause is missing bounds validation on an attacker-controlled counter field. The PEF loader trusts relocSecCount from the file header without cross-checking it against the section table size or the remaining bytes in the input buffer. This is a classic uncontrolled resource consumption pattern ([CWE-400]).

Attack Vector

The attack requires local file access and user interaction. An attacker delivers a small crafted Apple PEF file to a target analyst. When the analyst opens the file or when an automated pipeline runs binary format auto-detection over the sample, radare2 enters the unbounded relocation loop. The process consumes CPU and becomes unresponsive until terminated. No code execution or data disclosure occurs; the impact is confined to availability.

Refer to the GitHub Security Advisory GHSA-fg6f-rj8g-25pq and the remediation commit for technical details on the fix.

Detection Methods for CVE-2026-81880

Indicators of Compromise

radare2 processes (r2, rabin2, radare2) consuming sustained high CPU while analyzing a single input file
PEF-format files with anomalously large relocSecCount header values relative to file size
Analyst workstations or automated triage sandboxes showing r2 processes that fail to terminate within expected analysis windows

Detection Strategies

Inspect suspect samples with a PEF header parser and flag files where relocSecCount exceeds the section count or where declared relocation offsets extend beyond file length
Instrument automated malware pipelines that invoke radare2 with per-file CPU-time and wall-clock timeouts, and log any samples that exceed thresholds
Alert on repeated radare2 crashes or timeouts across a fleet, which may indicate distribution of crafted PEF samples

Monitoring Recommendations

Track radare2 version deployed on analyst endpoints and CI runners; alert on versions prior to 6.2.0
Monitor process runtime and CPU utilization for reverse engineering tools in shared sandbox infrastructure
Log file hashes and sources of any PEF samples that trigger analyzer timeouts for later correlation

How to Mitigate CVE-2026-81880

Immediate Actions Required

Upgrade radare2 to version 6.2.0 or later on all analyst workstations, servers, and automated pipelines
Audit CI/CD and malware-analysis pipelines that shell out to r2, rabin2, or radare2 language bindings, and enforce per-invocation CPU and wall-clock limits
Treat untrusted PEF samples as capable of causing analyzer denial of service until patching is confirmed

Patch Information

The fix is available in radare2 release 6.2.0. The patch is applied in commit 87c780e29ee6251cebaab51585d14482cb7740ac, which bounds relocSecCount against the section count and validates that relocation record offsets remain within the input buffer.

Workarounds

Run radare2 inside a resource-constrained container or sandbox with ulimit CPU-time caps and memory limits
Pre-filter incoming samples and reject or quarantine PEF files whose header relocSecCount exceeds a sane threshold
Disable automatic binary-format auto-detection over untrusted directories and require explicit user invocation on individual files

bash

# Enforce CPU-time and memory limits on radare2 invocations
ulimit -t 30       # 30 seconds CPU time
ulimit -v 1048576  # 1 GB virtual memory
timeout 60s r2 -A -q -c 'quit' /path/to/sample.pef