CVE-2026-81886mediumCWE-770

CVE-2026-81886: fallo de gravedad media en radareorg radare2

radare2: Uncontrolled memory allocation in radare2 dmp64 parser

Publicada el

Seguir esta CVE+ Monitorear radare2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.5epss 0.2%
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size. This can cause denial of service through excessive memory consumption and processing time. This issue is fixed in version 6.2.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Productos afectados
radareorg · radare2
CVEs relacionadas — radareorg radare2

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-15121HIGHCommand injection in Radare2EPSS 1.6%CVE-2026-40499HIGHradare2 < 6.1.4 Command Injection via PDB Parser print_gvars()EPSS 1.2%CVE-2026-40517HIGHradare2 < 6.1.4 Command Injection via PDB Parser Symbol NamesEPSS 1.1%CVE-2026-40527HIGHradare2 Command Injection via DWARF Parameter NamesEPSS 0.9%CVE-2025-1744CRITICALOut-of-bounds Write in radare2EPSS 0.5%CVE-2025-1864CRITICALBuffer Overflow and Potential Code Execution in Radare2EPSS 0.5%