A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is assessed as difficult. Upgrading to version 6.2.4 is capable of addressing this issue. The patch is named 18fd12efa98a7d1977de7bdd379d8a848777b90f. Upgrading the affected component is recommended. The pre-requisite of the vulnerability is reflected by the CVSS vector. One of the project maintainers explains: "There is a real sandbox configuration issue here, but the report overstates it. The HTTP server defaults to http.sandbox=true, so commands received through /cmd temporarily enable cfg.sandbox. However, cfg.sandbox.grain defaults to all, which means all sandbox capabilities - including exec - remain allowed. Therefore enabling the HTTP sandbox alone does NOT prevent commands from spawning processes. This only matters when the HTTP command endpoint is reachable by someone you do not trust. It is not a remote vulnerability by default: the HTTP server must first be started and exposed to the attacker."
CVE-2026-81886 is a medium severity vulnerability in radare2 prior to version 6.2.0. It involves the Windows 64-bit crash-dump dmp64 parser, which improperly uses an input-controlled PageCount to allocate memory without validating against the dump size. This can lead to excessive memory consumption and processing time, causing a denial of service. The issue is fixed in radare2 version 6.2.0.
CVE-2026-81885 is a medium severity vulnerability in radare2 prior to version 6.2.0. The issue involves the NE relocation fixup-chain parser, which lacks iteration limits or cycle detection when processing relocation entries. An attacker can trigger a denial of service by opening a crafted NE executable that causes the parser to repeatedly allocate resources indefinitely, leading to excessive CPU and memory consumption. This vulnerability is fixed in radare2 version 6.2.0.
CVE-2026-81884 is a medium severity vulnerability in radare2 prior to version 6.2.0. It involves an out-of-bounds read in the Mach-O LC_DATA_IN_CODE parser when processing crafted Mach-O files with the non-default bin.verbose option enabled. This flaw can cause heap memory to be read beyond its allocated buffer, potentially leading to process termination. No memory disclosure or attacker-observable impact has been demonstrated. The issue is fixed in radare2 version 6.2.0.
CVE-2026-81883 is an out-of-bounds read vulnerability in radare2's Lua 5.3 bytecode function parser affecting versions prior to 6.2.0. The parser reads fixed function-metadata fields immediately after a function-name string without verifying buffer boundaries, leading to reads beyond the allocated input buffer. This can cause invalid parsing results or process termination. No memory disclosure or attacker-observable information leak has been demonstrated. The issue is fixed in radare2 version 6.2.0.
CVE-2026-81882 is an out-of-bounds read vulnerability in radare2's binary property-list Unicode parser prior to version 6.2.0. The vulnerability occurs because the parser underallocates an uninitialized UTF-8 destination and does not guarantee NUL termination. Triggered by running the pFB or pFBj commands on untrusted binary property-list data, this causes the JSON encoder to read beyond the allocated buffer, potentially disclosing uninitialized or adjacent heap memory. The issue is fixed in radare2 version 6.2.0.
CVE-2026-81881 is an out-of-bounds read vulnerability in radare2's Mach-O Swift field-metadata parser prior to version 6.2.0. The flaw occurs when a relative Swift field pointer is lower than the field-metadata section base, causing a negative logical index and reading memory before the allocated buffer. This can lead to incorrect metadata processing or process termination, but no memory disclosure has been demonstrated. The issue is fixed in radare2 version 6.2.0.
radare2 versions prior to 6.2.0 contain a vulnerability in the Apple Preferred Executable Format (PEF) loader where unbounded relocSecCount values can cause excessive processing. This flaw allows the loader to perform an extremely high number of relocation-section iterations and buffer operations beyond the end of the file, leading to denial of service via high CPU consumption. The issue is resolved in version 6.2.0.
CVE-2026-81879 is an out-of-bounds read vulnerability in radare2's ELF parser affecting versions prior to 6.2.0. The issue arises from improper handling of the ELF PN_XNUM field, where the program-header array is allocated based on a resolved count but iterated using an original, larger count, leading to heap out-of-bounds reads. This can cause process termination and denial of service. There is no evidence of memory disclosure or code execution exploitation. The vulnerability is fixed in radare2 version 6.2.0.
An integer overflow vulnerability exists in radare2's CPython bytecode .pyc marshal parser prior to version 6.2.0. The vulnerability occurs because the parser accepts a 32-bit string length that can overflow the allocation size, leading to heap memory corruption when processing crafted .pyc files. This can cause denial of service, and while arbitrary code execution is possible, it has not been demonstrated. The issue is fixed in radare2 version 6.2.0.
A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.
A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulation results in integer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 11ac224c0eb8d57830fccc99e1c1cd8e5d958813. It is best practice to apply a patch to resolve this issue.
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.