CVE-2026-81885

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0

Description The NE relocation fixup-chain parser in radare2 lacks an active iteration limit or cycle detection. When opening a specially crafted NE executable where an in-bounds relocation entry points back to itself rather than reaching 0xffff, the parser repeatedly processes the same relocation and allocates a new relocation object during each iteration. This behavior leads to a denial of service due to continuous CPU and memory consumption.

Recommendations Update to version 6.2.0.