CVE-2026-81880Active Exploitation(radare / radare2)

MEDIUMCVSS 5.5 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch radare radare2 systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.

radare CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac

Vendor / third-party advisories

https://github.com/radareorg/radare2/security/advisories/GHSA-fg6f-rj8g-25pq

Other references

https://github.com/radareorg/radare2/releases/tag/6.2.0

Weakness type (CWE)

CWE-400CWE-834

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

radare2

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

radare

Products

radare2

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://sec.kaitan.id/cves/CVE-2026-81880

Full discourse1 post

Kaitan ID Security@KaitanSecurity47d
Active Exploitation
⚠️ HIGH — CVE-2026-81880 radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferre… CVSS 5.5 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-81880 #Apple #CyberSecurity #InfoSec
Post summary
The tweet reports CVE-2026-81880 in radare2 (affecting versions before 6.2.0, CVSS 5.5) and claims active exploitation in the wild, with a link to a full analysis page.
10010103
90 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	radare	radare2	-	-	-

Explore more

Back to dashboard radare CVEs radare2 vulnerabilities