CVE-2026-81878 radareorg CVE debrief

Who should care

Defenders responsible for radare2 installations, especially in environments where .pyc files are processed, should assess exposure and prioritize updates. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-81878 is a vulnerability in radare2's CPython bytecode .pyc marshal parser that can cause heap memory corruption and denial of service. Defenders should prioritize verifying and updating radare2 to version 6.2.0 or later, especially in environments where .pyc files are processed.

• Denial of service due to heap memory corruption
• Potential for arbitrary code execution requires verification
• Need to verify and update radare2 to version 6.2.0 or later

Technical summary

The CPython bytecode .pyc marshal parser in radare2 is vulnerable to heap memory corruption and denial of service when processing crafted .pyc files. The vulnerability is caused by a 32-bit string length that overflows the size-plus-one allocation. This issue is fixed in version 6.2.0. Defenders should prioritize verifying and updating radare2 to version 6.2.0 or later, especially in environments where .pyc files are processed. The vulnerability can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated.

Defensive priority

Defenders should prioritize verifying and updating radare2 to version 6.2.0 or later, especially in environments where .pyc files are processed.

Recommended defensive actions

• Verify and update radare2 to version 6.2.0 or later
• Restrict access to .pyc files to trusted sources
• Monitor for suspicious .pyc file activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2, potentially leading to heap memory corruption and denial of service. The CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.