{"id":"CVE-2026-81880","summary":"radare2: Uncontrolled resource consumption in radare2 PEF loader","details":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.","aliases":["GHSA-fg6f-rj8g-25pq"],"modified":"2026-09-24T08:34:27.457372Z","published":"2026-09-22T15:09:48.887Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81880.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-834"]},"references":[{"type":"WEB","url":"https://github.com/radareorg/radare2/releases/tag/6.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81880.json"},{"type":"ADVISORY","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-fg6f-rj8g-25pq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81880"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"87c780e29ee6251cebaab51585d14482cb7740ac"},{"fixed":"e1fc278734ad62f933fc6f91edb29e4ba732f402"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.2.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.1.8","6.1.6","6.1.4","6.1.2","6.1.0","6.0.8","6.0.7","6.0.6","6.0.4","6.0.2","6.0.0","5.9.8","5.9.6","5.9.4","5.9.2","5.9.0","5.8.8","5.8.6","5.8.4","5.8.2","5.8.0","5.7.8","5.7.6","5.7.4","5.7.2","5.7.0","wip","5.6.8","5.6.6","5.6.4","5.6.2","5.6.0","5.5.4","5.5.2","5.5.0","5.4.2","5.4.0","5.4.0-git","5.3.1","5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81880.json","vanir_signatures_modified":"2026-09-24T08:34:27Z","vanir_signatures":[{"digest":{"function_hash":"324112514328379812876858145547156779990","length":330},"id":"CVE-2026-81880-1ef91f2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac","target":{"file":"libr/bin/p/bin_pef.c","function":"push_reloc"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac","target":{"function":"relocs","file":"libr/bin/p/bin_pef.c"},"deprecated":false,"digest":{"function_hash":"325008253209019321562908375210784562208","length":909},"id":"CVE-2026-81880-4bc56653"},{"target":{"file":"libr/bin/p/bin_pef.c","function":"do_reloc_bytecode"},"deprecated":false,"digest":{"function_hash":"198235475469693682278649310242906958286","length":5499},"id":"CVE-2026-81880-7cd1dfe7","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac"},{"deprecated":false,"digest":{"line_hashes":["295024283854975729068861154256108496062","118530727822571747824496746975763556313","181764032421134939457573354001429368821","252586169577554057969656638143329325381","198557988508437039033952057533159644016","159557884124414036674777592752393811336","97087241326709152977535536903107032918","499997325271785537170132572058393511","195973045939795186100821600119001771111","242708720034175570700027807789867016348","246084198828441669154809318777687574369","137949818590376224950587428758667517643","320070420474875768019483169664398673669","93053217742947102600081664771335703509","314105465468789538014811518356682349691","223790213939518795004437577933268004097","222701913735175659297180341700679115997","290618930098694384978485156278193013846","168140562148196299143498528195027721644","251277664695399752843386802630630117628","180440580447500525481110641031852646924","122858028210838507742587266960762711149","191958063970281646724671922160975482946","173582685745633503429583277600558661448","11807089266473370046963962918998374628","313555800472945512957415656314894242570","267777422944480727879036717030158004467","332265217239755314289414025630449820489","84348022337650713868236863471269494370","258690078235184171081988509457669163324","287492880458305824141233116607655351915","55898120080497119074677367599100418129","139976178931277307445598535099249587259","89769115125429623322489588186093733643","130666509220497921124574421166022866904","91605058596903994911214761049083646061","127074720309862963404733545481182928820","248926181905291592679611257726526382908","179789621232266199658133609032923821543","144092701450877588022848953619497314918","62228246663424755138278699020238368440","135856019527725802496364817300399830771","65179065327689989176893525501414321982","102852102463403124827393134350629755324","325256241300028292112347964882546977273","153234798899187957685791015973965880106","112208605997552592344313745519556404870","53420003712401932139869345527669213718","50502540731667061505262841943943424437","125521736614492640539733441703804376978","294422968400645300827699768931447029741","167310236502359356382544172985800613546","219333873894400869034607351861418642355","112208605997552592344313745519556404870","80701070888086942652833613883286507649","144594721971901169383124619324587888118","91943690922299410438173389900462247977","316748273628575584381990634952124464905","61374609559027626309743636359815918916","186385503035217827315731069183324710784","276948868412673583560759971636397108395","153234798899187957685791015973965880106","112208605997552592344313745519556404870","74148619934139565277313415629661358233","102013364757633696093404201516276031293","306847703091388681571580132696739841786","122024940121838939501326134211591357570","53981253747782022278153512018909402028","318478038898797458890162908538545458608","167310236502359356382544172985800613546","219333873894400869034607351861418642355","149062811268451695303625859729597687239","179842584432419891170380954191617702131","276301824563653492633713166490196733224","87147481204485887403178451247532112986","195986178190578070756168449708447307035","201408612090884698917811606343077241877","161028991753283727434041829635585798540","254608686257735129497741701094904115195","3543587657184217506949463670021509948","186580604041231803303756627639641887789","22484219743705685401714395447907900905","167310236502359356382544172985800613546","219333873894400869034607351861418642355","149062811268451695303625859729597687239","179842584432419891170380954191617702131","276301824563653492633713166490196733224","153234798899187957685791015973965880106","112208605997552592344313745519556404870","62352206745268677026720870415574734884","68741078342927732902075405512998966148","199626515675116837473464963769138775058","97357394301632542174482405464733975756","286231844782411486128604911461495971458","253939471556440812292892445697333939851","276948868412673583560759971636397108395","87147481204485887403178451247532112986","195986178190578070756168449708447307035","163562266933720996334538352116062679022","2347348399656172272337396277070430709","118293933638145818927760933729486186944","306238663577143539163765241070642170414","79188956058266608032960094519358470973","266262640147626978644148579215683944945","188857253460777542175703614649380536822","144430168690920422788616655454841179495","185117373599916025283387554515296372397","298783533225339864379829217731536506819","14402964300259809567034138342503026434","131640376563780548607541091406188289069","222506813436447733246995798180444982685","278022459391001132493248146214156481954","317938644513043703294927918938223927788","325850488736166210459428650321870096828","79169817117197926912788699128539648191","188987741047213651759332047082206391664","66171091937838070008632861587974907769","280254009194718928113058887253972580213","8325603121220295334624780498412447064","335332346401937436982026199004550755540","207115086246202998715555709964549762753","205896725781779637037531107398735703780","314951497869368099442807477096119109244","156742796987492760485585558916652475528","59236943514726848741714177168295532394","80278163392128152615859660863601045899","146475884942254507369104492986646882876","125391834620643271713797115781669442032","305339344850163069241261870791448758966","230081386385834779835576569794938693643","44554634120778605218523776449455502213","118147648977255053210614373680291524138","109013461899453134665309381112139146142","188987741047213651759332047082206391664","66171091937838070008632861587974907769","93919308162383351431912981005127573767","44844392792110290231285401049644783500","340188788655914158026413432235754123863","200861134599920988617005698356188703524","325635071449161997247271580183797799458","314951497869368099442807477096119109244","192912249132733112105611759787579843250","134851003568602428695795926812185008929","256851805169875678050356070051000160917","174743532934724051410375363993002926051","264687513142278438745035988388021388257","306017483041109663126793878314691133648","285148819359231991271331449158685962179","163462752560838113240964339847366306828","31439885329515436167539358327068076963","148579269379752979791761307009586610265","304269736332620024155249428029887148496","82497754991073257303242291575013312307","328971764705040125803619207722951282687","224425781522203433478495554031858278224","238172275395186710830592272959079888604","85203513480809052686329055867592470403","46470892017927727878143345049173652076","82375609078443655918210895607117780119","110932835773148568436283279167794167495","42676922814883707370910522208698913343","139387894493722684693064260557091611961","215457925227913259625192596574916567708","37001473295486461500940889465650009150","339367463434089196421700004981454139318","136559258239137831777834997678566413824","307191249391876248521830931035321599334","127558089978267017195818685931442657680","297161758614696274530016716463766152187","209877551013513585781356839331974815934","305113406381066713277143728683914631610","144213584228273856210179398759843024453","97330425220071696869412378300698934987","146083724315283301826465817252727762447","333415253611251523590283583194485500053","99910381664654754130101592441952755154","181331925739746980951040986895202838066","323219135717853216890783088159375398546","166635315977997931739716670566584313885","276313468301456185157143953660621571216","128602623895142489431154930913351700371","125165856266168487392173744563080721718","322752663659582775960876152637279609157","296577113440208184658763727482864194292","49465795727263074868819902739857000308","15528950815463967067095530421791788388","178118675155973304008354934392386820469","79275921926772769795950885472002120887","26012415431000999357398528967250431773","89081900317109180208416498101071662987","103391399090134443973685571447887388644","197484296465244551978145805299566186525","127514947895825272333786879779768368613","113644458195000464891652684643958533664","51116905695514383212504869991821346175","260070950116204427969555201072703438069","283376125867939126444214775945246123712","24720727229375218160502622657419430565","63023319149774050960125992398873200987","247372444007269458036090414453414845435","62097463567307906493256088113365029899","138377151207266812609006725938624814649","96795876107268074988380993965144692324","69580136611683150414315902815586149308","42622108474508039079308773490358951310"],"threshold":0.9},"id":"CVE-2026-81880-cc99aaab","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac","target":{"file":"libr/bin/p/bin_pef.c"}},{"signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac","target":{"function":"load","file":"libr/bin/p/bin_pef.c"},"deprecated":false,"digest":{"function_hash":"313449569979024027267902073144209190524","length":3475},"id":"CVE-2026-81880-effc1706","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}