Executive brief
radare2 is a reverse engineering framework that analyzes binary files. A crafted Apple PEF (Preferred Executable Format) binary can trigger unbounded relocation processing, causing the application to consume excessive CPU and hang for extended periods. An attacker can deliver such a malicious file to a security analyst or researcher, disrupting their work and potentially denying access to legitimate analysis.
Technical details
The PEF loader accepts unbounded relocSecCount values without validating them against the actual number of file sections or relocation records, allowing up to 268 million iterations. A crafted PEF file triggers this vulnerability during normal binary-format auto-detection, causing the loader to perform excessive buffer operations and relocation processing. The vulnerability is fixed in version 6.2.0 by adding bounds checking, overflow validation, and lazy decoding of relocation metadata.
Affected products
- radare2 radare2 before 6.2.0
Timeline
- 2026-09-22: disclosed
- 2026-08-07: patched