Is CVE-2026-81879 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81879 being exploited in the wild.

How severe is CVE-2026-81879?

Medium severity, with a CVSS score of 5.5, published 22 September 2026.

Which products and versions are affected?

Radareorg Radare2 prior to 6.2.0.

Is there a fix for CVE-2026-81879?

A patch was published on 2026-07-06: Fix commit 9449b07 merged to master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81879 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-81879?

Check whether you run Radare2 or Radareorg Radare2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81879: radare2 heap out-of-bounds read in ELF PN_XNUM handling

CVE-2026-81879 · Severity: medium · CVSS 5.5 · Published 2026-09-22

radare2 is a reverse engineering framework used to analyze binary files and malware. When processing a specially crafted ELF executable file, a mismatch between the reported and actual program header count causes the parser to read far beyond allocated memory, triggering a crash. An attacker can craft a malicious ELF file to deny service to analysts and security tools using radare2.

Technologies: Radare2, Radareorg Radare2. Vendors: Radare, Radareorg.

Quick answers

Is CVE-2026-81879 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81879 being exploited in the wild.
How severe is CVE-2026-81879?: Medium severity, with a CVSS score of 5.5, published 22 September 2026.
Which products and versions are affected?: Radareorg Radare2 prior to 6.2.0.
Is there a fix for CVE-2026-81879?: A patch was published on 2026-07-06: Fix commit 9449b07 merged to master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81879 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-81879?: Check whether you run Radare2 or Radareorg Radare2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability occurs in the ELF parser's handling of PN_XNUM (0xffff sentinel) program header counts. When e_phnum is set to 0xffff, the parser reads the true count from shdr[0].sh_info and allocates a buffer for that smaller count, but fails to update e_phnum itself. Consuming loops then iterate 0xffff times over the small allocation, causing heap out-of-bounds reads up to ~3.6 MB. The issue is triggered by opening a crafted ELF file and affects multiple parsing functions that iterate over program headers.

Affected products

radareorg radare2 prior to 6.2.0

Timeline

2026-09-22: disclosed
2026-07-06: patched: Fix commit 9449b07 merged to master

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.