Executive brief
radare2 is a reverse engineering framework used to analyze binary files and malware. When processing a specially crafted ELF executable file, a mismatch between the reported and actual program header count causes the parser to read far beyond allocated memory, triggering a crash. An attacker can craft a malicious ELF file to deny service to analysts and security tools using radare2.
Technical details
The vulnerability occurs in the ELF parser's handling of PN_XNUM (0xffff sentinel) program header counts. When e_phnum is set to 0xffff, the parser reads the true count from shdr[0].sh_info and allocates a buffer for that smaller count, but fails to update e_phnum itself. Consuming loops then iterate 0xffff times over the small allocation, causing heap out-of-bounds reads up to ~3.6 MB. The issue is triggered by opening a crafted ELF file and affects multiple parsing functions that iterate over program headers.
Affected products
- radareorg radare2 prior to 6.2.0
Timeline
- 2026-09-22: disclosed
- 2026-07-06: patched: Fix commit 9449b07 merged to master