CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 prior to 6.2.0 contains a denial-of-service vulnerability in its NE relocation fixup-chain parser . The parser followed fixup chains without an iteration limit or cycle detection, so a crafted NE executable containing an in-bounds relocation entry that points back to itself causes the par...

CVE-2022-1238

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see CWE...