CVE-2026-81886

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0

Description The Windows 64-bit crash-dump dmp64 parser fails to validate the PageCount of a physical-memory-run against the actual dump size. When opening a specially crafted full-memory Windows crash dump, the parser uses this input-controlled value as the bound for a per-page allocation loop, repeatedly allocating and appending page descriptors. This leads to excessive memory consumption and processing time, resulting in a denial of service.

Recommendations Update to version 6.2.0.