CVE-2026-81885: radare2 NE Parser DOS Vulnerability

CVE-2026-81885 Overview

CVE-2026-81885 is a denial of service vulnerability in radare2, a UNIX-like reverse engineering framework and command-line toolset. Versions prior to 6.2.0 contain a flaw in the New Executable (NE) relocation fixup-chain parser. The parser followed fixup chains without an active iteration limit or cycle detection. A crafted NE executable containing a self-referential relocation entry causes the parser to loop indefinitely, allocating a new relocation object on every iteration. The result is continuous CPU and memory consumption until the process is terminated or system resources are exhausted. The issue is fixed in radare2 version 6.2.0.

Critical Impact
An analyst opening a malicious NE binary in radare2 triggers uncontrolled resource consumption, halting reverse engineering workflows and potentially exhausting host memory.

Affected Products

radare2 versions prior to 6.2.0
radare2 NE binary format parser (libr/bin/format/ne/ne.c)
Downstream tools embedding vulnerable radare2 libraries

Discovery Timeline

2026-09-22 - CVE-2026-81885 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-81885

Vulnerability Analysis

The vulnerability resides in the NE relocation parser inside libr/bin/format/ne/ne.c. NE files use fixup chains where each relocation entry stores an offset pointing to the next entry, with 0xFFFF marking the end of the chain. The pre-6.2.0 parser walked this chain in a do { ... } while (offset != 0xFFFF) loop with no upper bound and no visited-offset tracking.

When a crafted NE binary contains an in-bounds relocation whose offset points back to itself, the parser reads the same offset value on every iteration. The loop never observes 0xFFFF, so termination never occurs. Each iteration calls R_NEW0 (RBinReloc) and appends the new object to the relocation list, driving unbounded heap growth alongside pinned CPU usage.

The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Exploitation requires an analyst to open the malicious file, so user interaction is required and impact is limited to availability of the local host.

Root Cause

The parser trusted attacker-controlled offset values inside the NE file without enforcing a maximum chain length or tracking previously visited offsets. Combined with per-iteration heap allocation, the missing cycle detection turns a malformed relocation table into a resource exhaustion primitive.

Attack Vector

An attacker crafts an NE executable with a relocation entry whose paddr + offset resolves back to the same entry. The attacker delivers the file to a reverse engineer through malware analysis submissions, CTF challenges, sample sharing platforms, or automated pipelines that feed samples to radare2. Opening the file with r2, rabin2, or any tool linking against the vulnerable radare2 library triggers the infinite loop.

// Patch excerpt from libr/bin/format/ne/ne.c
// Fix infinite loop in the NE fixup parser
				reloc->additive = 1;
				r_list_append (relocs, reloc);
			} else {
-				do {
-#define NE_BUG 0
-#if NE_BUG
-					if (reloc->paddr + 4 < r_buf_size (bin->buf)) {
-						break;
-					}
-#endif
-					r_list_append (relocs, reloc);
+				int chainlen;
+				r_list_append (relocs, reloc);
+				for (chainlen = 0; chainlen < 0xFFFF; chainlen++) {
					offset = r_buf_read_le16_at (bin->buf, reloc->paddr);
-					RBinReloc *tmp = reloc;
-					reloc = R_NEW0 (RBinReloc);
-					if (!reloc) {
+					if (offset == 0xFFFF) {
						break;
					}
-					*reloc = *tmp;
-					if (reloc->import)
-						reloc->import = r_bin_import_clone (reloc->import);
-					reloc->paddr = seg->paddr + offset;
-				} while (offset != 0xFFFF);
-				free (reloc);
+					RBinReloc *next = R_NEW0 (RBinReloc);
+					*next = *reloc;
+					if (next->import) {

Source: Radare2 Commit 93d794c. The fix introduces a bounded for loop capped at 0xFFFF iterations and checks the terminator before allocating additional relocation objects.

Detection Methods for CVE-2026-81885

Indicators of Compromise

radare2, r2, or rabin2 processes consuming 100% CPU for extended periods after opening an NE file
Rapid resident set size (RSS) growth in radare2 processes until out-of-memory conditions occur
Analyst workstations invoking radare2 against NE binaries received from untrusted sources

Detection Strategies

Inventory installed radare2 versions across analyst and automated triage systems and flag any release earlier than 6.2.0
Monitor process telemetry for radare2 binaries exhibiting sustained CPU saturation combined with monotonic memory growth
Inspect suspicious NE samples for relocation entries whose computed target address equals their own address

Monitoring Recommendations

Alert on radare2 processes exceeding defined CPU-time or memory ceilings inside sandboxes and analysis VMs
Log command lines that pass NE files to r2, rabin2, or scripted radare2 pipelines for retrospective review
Track radare2 package versions through software composition analysis to identify vulnerable deployments

How to Mitigate CVE-2026-81885

Immediate Actions Required

Upgrade radare2 to version 6.2.0 or later on all workstations, servers, and automated analysis infrastructure
Rebuild and redeploy any downstream tools statically linking radare2 libraries against the patched release
Restrict radare2 execution to sandboxed environments with resource limits when analyzing untrusted NE binaries

Patch Information

The fix is available in radare2 release 6.2.0 and merged via pull request #26192. Details are tracked in issue #26225 and the GHSA-43wr-4j49-rcxj advisory. The patch enforces a bounded fixup-chain traversal capped at 0xFFFF iterations.

Workarounds

Avoid opening untrusted NE-format executables with vulnerable radare2 versions
Run radare2 under process resource limits using ulimit -v and ulimit -t to cap virtual memory and CPU time
Execute NE triage inside disposable containers or virtual machines with strict memory quotas

bash

# Cap radare2 memory and CPU time before opening untrusted NE samples
ulimit -v 1048576   # limit virtual memory to ~1 GiB
ulimit -t 30        # limit CPU time to 30 seconds
r2 -A suspicious_sample.exe