CVE-2026-81885mediumCWE-770CWE-835

CVE-2026-81885: medium-severity vulnerability in radareorg radare2

radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

Published · Updated

Follow this CVE+ Monitor radare2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.2%
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
radareorg · radare2
Related CVEs — radareorg radare2

In the same product, most dangerous first.

CVE-2020-15121HIGHCommand injection in Radare2EPSS 1.6%CVE-2026-40499HIGHradare2 < 6.1.4 Command Injection via PDB Parser print_gvars()EPSS 1.2%CVE-2026-40517HIGHradare2 < 6.1.4 Command Injection via PDB Parser Symbol NamesEPSS 1.1%CVE-2026-40527HIGHradare2 Command Injection via DWARF Parameter NamesEPSS 0.9%CVE-2025-1744CRITICALOut-of-bounds Write in radare2EPSS 0.5%CVE-2025-1864CRITICALBuffer Overflow and Potential Code Execution in Radare2EPSS 0.5%