Executive brief
radare2 is a reverse engineering toolkit used by security researchers to analyze software binaries and code. The tool's CPython bytecode parser accepts specially crafted .pyc files and fails to validate string length fields, allowing attackers to trigger a massive heap memory corruption by opening a malicious file. This can crash the application or potentially enable arbitrary code execution during analysis of untrusted bytecode.
Technical details
The CPython marshal parser in radare2's pyc format handler lacks a 32-bit integer overflow guard in the ASCII string object readers (get_ascii_object and get_ascii_interned_object). A length field of 0xffffffff wraps the allocation to zero when incremented, causing calloc(0) to return a minimal heap chunk. Subsequent reads then memset approximately 4GB of 0xff bytes into this undersized allocation, causing out-of-bounds heap corruption. The vulnerability is triggered automatically when opening a crafted .pyc file with r2 or rabin2 without requiring user interaction beyond file selection.
Affected products
- radare2 radare2 prior to 6.2.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched