CVE-2026-81878: CWE-190: Integer Overflow or Wraparound in radareorg radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated. This issue is fixed in version 6.2.0.
AI Analysis
Technical Summary
radare2 versions before 6.2.0 contain an integer overflow vulnerability in the CPython bytecode .pyc marshal parser. The parser accepts a 32-bit string length that can overflow the allocation size, specifically when a length of 0xffffffff causes the allocation to wrap to zero. This results in heap memory corruption and potential denial of service when opening or inspecting maliciously crafted .pyc files using radare2 or rabin2. While arbitrary code execution is possible in theory, no exploits have been demonstrated. The vulnerability is addressed in version 6.2.0.
Potential Impact
The vulnerability can cause heap memory corruption and denial of service when processing specially crafted .pyc files. Although arbitrary code execution is possible, it has not been demonstrated in the wild. There are no known active exploits. The impact is primarily local denial of service and potential memory corruption.
Mitigation Recommendations
This vulnerability is fixed in radare2 version 6.2.0. Users should upgrade to version 6.2.0 or later to remediate this issue. No vendor advisory is provided beyond this fix information. Patch status is confirmed by the version update. Until upgrading, avoid opening or inspecting untrusted .pyc files with radare2 or rabin2.
CVE-2026-81878: CWE-190: Integer Overflow or Wraparound in radareorg radare2
Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated. This issue is fixed in version 6.2.0.
CVSS v3.1
Score 5.5medium
Affected software
radareorg
radare2
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
radare2 versions before 6.2.0 contain an integer overflow vulnerability in the CPython bytecode .pyc marshal parser. The parser accepts a 32-bit string length that can overflow the allocation size, specifically when a length of 0xffffffff causes the allocation to wrap to zero. This results in heap memory corruption and potential denial of service when opening or inspecting maliciously crafted .pyc files using radare2 or rabin2. While arbitrary code execution is possible in theory, no exploits have been demonstrated. The vulnerability is addressed in version 6.2.0.
Potential Impact
The vulnerability can cause heap memory corruption and denial of service when processing specially crafted .pyc files. Although arbitrary code execution is possible, it has not been demonstrated in the wild. There are no known active exploits. The impact is primarily local denial of service and potential memory corruption.
Mitigation Recommendations
This vulnerability is fixed in radare2 version 6.2.0. Users should upgrade to version 6.2.0 or later to remediate this issue. No vendor advisory is provided beyond this fix information. Patch status is confirmed by the version update. Until upgrading, avoid opening or inspecting untrusted .pyc files with radare2 or rabin2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-27T17:48:42.122Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab29c3cf7a7c54106580d62
Added to database: 09/22/2026, 15:18:20 UTC
Last enriched: 09/22/2026, 15:33:11 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.