CVE-2026-81878 radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
An integer overflow in radare2's PYC parser allows heap corruption and potential code execution when processing crafted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-81878?
CVE-2026-81878 is a medium-severity vulnerability in Radare Radare2, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated. This issue is fixed in version 6.2.0.
Which versions are affected by CVE-2026-81878?
It affects 1 product.
Products include Radare Radare2.
How do I fix CVE-2026-81878?
Upgrade to a fixed version.
Is CVE-2026-81878 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81878 exists.
Other vulnerabilities in Radare Radare2
Sources
Also known as GHSA-9phv-v2w8-56j3, UBUNTU-CVE-2026-81878.