CVE-2026-81880 radareorg CVE debrief

Who should care

Defenders responsible for radare2 installations, particularly those processing Apple PEF files, should assess exposure and prioritize verification and updates. Defenders should prioritize verifying radare2 installations and assessing exposure to crafted Apple PEF files. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

Defenders should prioritize verifying radare2 installations and assessing exposure to crafted Apple PEF files due to a vulnerability in the PEF loader prior to version 6.2.0, which can cause denial of service through excessive CPU consumption and prolonged processing.

• Denial of service through excessive CPU consumption
• Prolonged processing of crafted Apple PEF files
• Potential for system resource exhaustion

Technical summary

The radare2 PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input, leading to excessive CPU consumption and prolonged processing. This can cause denial of service through excessive CPU consumption and prolonged processing of crafted Apple PEF files. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This issue is fixed in version 6.2.0. Defenders should prioritize verifying radare2 installations and assessing exposure to crafted Apple PEF files.

Defensive priority

Defenders should prioritize verifying radare2 installations and assessing exposure to crafted Apple PEF files.

Recommended defensive actions

• Verify radare2 installations and assess exposure to crafted Apple PEF files
• Update radare2 to version 6.2.0 or later
• Monitor for suspicious Apple PEF file processing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file, leading to up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets pass the end of the file. The loader could perform excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.