{"id":"CVE-2026-81879","summary":"radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling","details":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated. This issue is fixed in version 6.2.0.","aliases":["GHSA-jqfq-hvcp-xh4p"],"modified":"2026-09-25T08:24:10.532366Z","published":"2026-09-22T15:09:01.910Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81879.json"},"references":[{"type":"WEB","url":"https://github.com/radareorg/radare2/releases/tag/6.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81879.json"},{"type":"ADVISORY","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-jqfq-hvcp-xh4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81879"},{"type":"REPORT","url":"https://github.com/radareorg/radare2/issues/26223"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"type":"FIX","url":"https://github.com/radareorg/radare2/pull/26178"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"fixed":"e1fc278734ad62f933fc6f91edb29e4ba732f402"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.2.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.1.8","6.1.6","6.1.4","6.1.2","6.1.0","6.0.8","6.0.7","6.0.6","6.0.4","6.0.2","6.0.0","5.9.8","5.9.6","5.9.4","5.9.2","5.9.0","5.8.8","5.8.6","5.8.4","5.8.2","5.8.0","5.7.8","5.7.6","5.7.4","5.7.2","5.7.0","wip","5.6.8","5.6.6","5.6.4","5.6.2","5.6.0","5.5.4","5.5.2","5.5.0","5.4.2","5.4.0","5.4.0-git","5.3.1","5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81879.json","vanir_signatures_modified":"2026-09-25T08:24:10Z","vanir_signatures":[{"digest":{"function_hash":"337278525430429154756118529790738502431","length":994},"id":"CVE-2026-81879-0ddb2c73","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(load_fields)"},"deprecated":false},{"id":"CVE-2026-81879-21733336","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c"},"deprecated":false,"digest":{"line_hashes":["124174577765083776651989505225247187769","95440894414143185553672211116277899623","48729590592558948320753444766388741447","273291845083423352872756672669231780508","90478996456423134759030744467101155043","126272444866225136615144496754567225682","298268721127206854456638671083568515752","157002099875924840484720899789365143007","119859888771645232423853910942863963095","18740488846885105248095094502656575764","233461550439934206145738418106863639107","101659993840555633208628900882044694606","21333327948760150092983885537066956594","218965122445619900918165089963977254712","156323494768217709661375804071095562348","187176728823239358559060022725086071474","292249233455512192083673084530849885656","141507336062500339976277622655662147227","269934554654166838123648838336687348817","43811442612459962958049156209741625139","170639800525742816325203326835034630411","143444101895433777087672802699534947804","266129161201599643702420092032073776405","282388942333363900491194754300013046700","161735626171671270690569343635428059601","52857068537344283862995973618347408195","59354545295927972600748174922371769637","227005379204671975552662450933663638775","102043933621966047910128482107542947392","286307542522688483527639996732412777422","274230382895858098847279317363385278315","115582448219120243998924402082473894420","170537274179853349089695146331991438723","149792995813472871169608954192903445727","21277975057993438660552714667960728120","44984535046540390676335945449544071231","129953173526506473498544532701645838758","286493265653326824746776353717427010335","19758552864717080163119851412949075690","79467410218474005684247183585228756739","79272886325237058682873344715893029138","154772917258320316644482206609950218963","306034391268332666658338786905651832151","55636072053695439020676450918896029433","176525540803047367850310151855157816960","190245715574326287236868696703858095745","331592969939729986595289860514711259461","23526212494716814443893250711246435554","127158244414511940434515437822815000423","286763397667428625345406652630674063667","106931390020402991584169304420638689829","54318613069207710628126326630507586422","314022271188128408742726719362108134717","138268634233628851032280490872495910242","47119268448279252059153631856872926548","76045058777000945308796210996275214658","325268168444151937456171658154653420504","110926755177228333608942560250722301932","285957319976587301887384363228621880765","117885612602158844469674323666311946988","88713468907070077293251597438201472722","5727746644603902196199849851867702232","155909990923052479975972663987537963751","194344017213214425236436159868516496516","273011745133017095688797394173633556450","326025116268938216995884850422482381861","67769021144936525362612616931659170879","104314316041778698526947560888131783192","126585319729327855451670822294452029497","141984403923880373574872975423243991736","199696495481782345456327317451246065012","306690070595740375771604900354770641409","230123018362087712741858433598430613272","335603920573963566590862429071136615218","96640078082195418180233824594680333568","191710970614960531438039204158349773161","25290956389652383069423735132007221634","141984403923880373574872975423243991736","140001950058696359302857779363808590972","329191729294193422072564431033071306507","337569915207043626057179095680204650839","62392204714498915777417640966738947657","140001950058696359302857779363808590972","157792588194005877310273775868373115006","210352425732666232194599038834631592845","247011818036460257058170874119903136206","313775852348397866952486527647672505413","278876875701462323373301034455344856213","5744914459513199741289963247252503493","308690512826840131194059854329205044146","127351948179285352528918573806060641200","228766336654889450868357088313288240442","72643796997599220061981725350274686380","210352425732666232194599038834631592845","168868454675605151177937447814793075444","315647006072873396800003723463314030945","280092238876339986930496534339959485463","326953748613755137200235580811657439254","101922261858581407788001634244206694822","103334523883034234513498222163232069590","303633351499677299090305946194785847330","4904039697091317119585967481054782553","151831515263020565242506748092876304405","219314066991830966499555463763481277951","231077974408925339090373079830155657400","65105027536747796755252886414615283783","5490047290617328257426670018972126336","317060191535775121047711029884388309427","91948011184129788524180894932605528654","77545731284871891003370154409510927123","217223153315053734643757306633116019662","240886914971883114251458894418452427524","57422751031510058877175078098636520950","313964016486081989141632566696629987285","268080109383986988453423798665809526627","235625198869828527858859768678917012333","171222947182120856948274237031756735685","263209206078779259554753910785558070091","162365351735472098670514034981276919205","306156318953433833565518924789417904937","133305603342606815393345419492277281124","159789066216559503530095427321086305648","265332190235994543636437073496839410946","81721318047562441125850536029784028220","270417942645699903600415292718791588552","158615140763785942068348790230616539348","102902323242108399619998494772392228196","102441924420318254769080255533779275102","279415591618592995062837443765052456475","253282782257776047524897011275881280489","141984403923880373574872975423243991736","68189617227120076208203597834545846873","270123435081196518634458475120344565928","330975768678725262064561404773798409249","320781136859481112676703636897783619068","53824019563490488752337033591838657234","307154869440581095446111812227127799629","143784122687254029174782185054150327037","36795977106427474913410299066065899948","305717450839289539842445622390409852048","311724385290938959079175709621362765541","236984909457136913671967817254549975233","56696023885753522834374621716719226535","233817496235475002730790419923497379135","310882109565580586336720931860510968088","184459225468748213630233656785021696646","183141072776195158760195404170228583830","58675115816967553644032640169201768823","310988836070227977316860413444330406207","54994017702647476696677194498522470002"],"threshold":0.9}},{"digest":{"function_hash":"63690867793402007507994864596390323961","length":424},"id":"CVE-2026-81879-2237ac5c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(get_boffset)"},"deprecated":false},{"digest":{"function_hash":"58211027783212075133768386169638483362","length":1264},"id":"CVE-2026-81879-27051c20","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"load_sections_from_phdr"},"deprecated":false},{"target":{"file":"libr/bin/format/elf/elf.c","function":"(get_phnum)"},"deprecated":false,"digest":{"length":603,"function_hash":"136816769691360011899768742070999148403"},"id":"CVE-2026-81879-2b67b6e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(get_baddr)"},"deprecated":false,"digest":{"length":477,"function_hash":"630428141744805458979366278747439120"},"id":"CVE-2026-81879-2fb8869a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libr/bin/format/elf/elf.c","function":"(intrp)"},"deprecated":false,"digest":{"function_hash":"187007983492425411700179461257109215873","length":814},"id":"CVE-2026-81879-32521359","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"deprecated":false,"digest":{"function_hash":"82483444809835955604300178317052848058","length":1819},"id":"CVE-2026-81879-39c2f7d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"function":"init_phdr","file":"libr/bin/format/elf/elf.c"}},{"deprecated":false,"digest":{"function_hash":"285495788494936090396934176315910073669","length":2286},"id":"CVE-2026-81879-4e604a6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(get_bits)"}},{"digest":{"length":632,"function_hash":"331647253064541145594903586035739898074"},"id":"CVE-2026-81879-5379b06e","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(compiler)"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"338791419017265827089898323579508470205","length":1695},"id":"CVE-2026-81879-5b583e43","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"load_symbols_from_phdr"}},{"digest":{"function_hash":"11297980649522669076614867204827598813","length":1289},"id":"CVE-2026-81879-5f114708","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"function":"init_dynamic_section","file":"libr/bin/format/elf/elf.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(v2p)"},"deprecated":false,"digest":{"function_hash":"179344963405098709739843217274887350787","length":753},"id":"CVE-2026-81879-64de5d89"},{"digest":{"function_hash":"18427275995665766591944149307962182298","length":66},"id":"CVE-2026-81879-7975ed22","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"_process_verneed_state"},"deprecated":false},{"id":"CVE-2026-81879-7aa2c491","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"get_dynamic_segment"},"deprecated":false,"digest":{"length":377,"function_hash":"135597603671636316985713001761208439239"}},{"target":{"file":"libr/bin/format/elf/elf.c","function":"init_shdr"},"deprecated":false,"digest":{"function_hash":"122821168724034741819996045066302888069","length":2750},"id":"CVE-2026-81879-82493ffd","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"deprecated":false,"digest":{"function_hash":"186903856376506656103231864283101457890","length":706},"id":"CVE-2026-81879-85ac139a","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"function":"(get_maps)","file":"libr/bin/format/elf/elf.c"}},{"id":"CVE-2026-81879-8869bd84","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(grab_regstate)"},"deprecated":false,"digest":{"function_hash":"285213227163360647594328111149744587870","length":1181}},{"deprecated":false,"digest":{"function_hash":"224710570020563099187159257679500527429","length":1812},"id":"CVE-2026-81879-8ff62146","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"get_nt_file_maps"}},{"source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(is_static)"},"deprecated":false,"digest":{"function_hash":"179191764345791972965372612403288975729","length":291},"id":"CVE-2026-81879-9779a18a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"142232550857731167154592903126516519363","length":253},"id":"CVE-2026-81879-b203fc39","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"function":"has_interp_program_header","file":"libr/bin/format/elf/elf.c"}},{"target":{"file":"libr/bin/format/elf/elf.c","function":"(p2v)"},"deprecated":false,"digest":{"function_hash":"109322329070451246441293627980986459978","length":876},"id":"CVE-2026-81879-bf3be1b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e"},{"digest":{"length":551,"function_hash":"166199345055151912197788829608660952374"},"id":"CVE-2026-81879-ef79de22","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"(has_relro)"},"deprecated":false},{"digest":{"function_hash":"66341970460949271968053103984879034314","length":290},"id":"CVE-2026-81879-f0b8db9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/9449b07579c19b6b187c1a0918fbec2cef1a036e","target":{"file":"libr/bin/format/elf/elf.c","function":"compute_has_nx"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}