CVE-2026-81884

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0

Description The Mach-O LC DATA IN CODE parser trusts dataoff and datasize and allows a final partial record to be processed. When datasize is not a multiple of data in code entry, the last iteration reads beyond the allocated buffer. This issue is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled, potentially leading to a heap out-of-bounds read and process termination.

Recommendations Update radare2 to version 6.2.0. Disable the bin.verbose option to prevent the trigger of this issue.