{"id":"CVE-2026-4174","summary":"Radare2 Mach-O File mach0.c walk_exports_trie resource consumption","details":"A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. Upgrading to version 6.1.2 is capable of addressing this issue. The name of the patch is 4371ae84c99c46b48cb21badbbef06b30757aba0. You should upgrade the affected component. The code maintainer states that, \"[he] wont consider this bug a DoS\".","modified":"2026-08-12T16:24:16.793673Z","published":"2026-03-15T10:32:10.553Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"5.9.9"},{"last_affected":"5.9.9"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-400","CWE-404"],"isDisputed":true,"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4174.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4174.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4174"},{"type":"ADVISORY","url":"https://vuldb.com/?id.351081"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.769799"},{"type":"REPORT","url":"https://github.com/radareorg/radare2/issues/25482"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.351081"},{"type":"FIX","url":"https://github.com/ToddAWalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0"},{"type":"FIX","url":"https://github.com/radareorg/radare2/milestone/94"},{"type":"EVIDENCE","url":"https://github.com/user-attachments/files/25620145/gen_macho_poc.py"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/toddawalter/radare2","events":[{"introduced":"0"},{"fixed":"4371ae84c99c46b48cb21badbbef06b30757aba0"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4174.json","vanir_signatures_modified":"2026-08-12T16:24:16Z","vanir_signatures":[{"id":"CVE-2026-4174-4e69acfb","signature_type":"Line","signature_version":"v1","source":"https://github.com/toddawalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0","target":{"file":"libr/bin/format/mach0/mach0.c"},"deprecated":false,"digest":{"line_hashes":["142196495732989083952396346693228342323","234118510478057294026385545460842961741","179539200476313868998545233872552719877","8996478778593505059088204477756130279","64858235625872399150398962564065023629","170511231471455087235683705447743259075","259964847177114049916284976928847688511","76930989746751669727092111474141649000","202950227292545415636023045926404986400","66627040926471146057570493175702674075","333764995835203698557592464208859367880","326299835490000309165908199556731873825","280513691181157568494018699679404610411","40654343988445973367470647450975683268","289610627381001427931953087787362524473","295935485398893110300561587178297648383","77863303345343446391395868867251117134","322149803007119750341475188527557691305","60170750650228589476058012977142449839","248776575511595703254964828356328740710","263718479385209546021431206186705938010","266016676274947636121228455903839161863","188806452010473003307526868928489389012","214541991886172315783354666437158117636","333444218175150107349902340247168669826","263553671563234230575284345397628086460","234068548800643205951003092898711760643","72160168675433987880953309214639017228","320205759847025276247926286415193567570","324383719627388250169252852970914740896","129472967678828384630638955576156116638","294187594236248694939368414737908004902","50563973003021737785163027650481329791","76777546499117694792455940150321312821","41323712714427693409088173164119210324","118850882996222751126062672907762277776","243161179089118522174147047986256025101","313638895594007774300337332266939999040","37620223958608704024582071070117763517","27575915509688533252532461955776328457","161575599145298539575085638986272256731","157819865482841173478998666477262416527","85464429588698895127650099116506075467","166968411156221333735904855792496938034","152107253334803460014266445690488769582","316979166449615729636317986013560490096","60210416465790803159700460772875897718","40548888382721386416651193902985823068","196224283061750880459641113702288488470","161280264838002366318937442819627359999","72488967664517078250644837173821689961","232005051063837734307575037207962903790","19986336617405558205862061214240837589","89895461693637798184451849336054453263","108379081985990510925704843922865651402","138055397897479015369770520622436619232","275773925929331167404920391762795380560","141233085168473328136956976612509754673","177243510891827968373928224584974489152","18203915665459612612710892464966405724","64077128966760733292791572633955345538","61944294943975012874078141932774986677","21811128353334499782704594997540739903","259039894339226913431657427837669054704","31300263140000120154105674685694464145","147630223296588399214495365092308689026","207253213448836816723938273594401912694","108603681786180692899320493209450678561","148147377082462834358787533997876033284","46448062813997579928156620826129707689","302464660227134524940351032069375673745","134358111909978326891382060270828961531","206822836077085520185043460035086089704","298475734962550518386506765183989671303","209437688654006823348287100580326737483","126292991301963344058966373498108061704","310976768348812136724022062357327673407","56692785355840005892853957168506299639","177735488593516479388065728382595168353","71789485133742872813290624749793711847","32310470122414365360255128970994796940","268359816890341035748547132711914600511","265296627231191344348516330237779557296","32029649100524360219053944330415113944","234101513997281450503580890018863866055","281971248596970562184963130403740447341","325608911563856591681838940497495996291","72750954903512450675444232442054557415","77788817801380689266918427499900954863","43382989809449035164217345398535615073","115951468810408215825880880495541098746","251026670540851079587755681551533325228"],"threshold":0.9}},{"id":"CVE-2026-4174-fdabc149","signature_type":"Function","signature_version":"v1","source":"https://github.com/toddawalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0","target":{"file":"libr/bin/format/mach0/mach0.c","function":"walk_bind_chains_callback"},"deprecated":false,"digest":{"function_hash":"323464168206330952485700540502452818145","length":1955}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}