A flaw was found in radare2, a UNIX-like reverse engineering framework. The CPython bytecode (.pyc) marshal parser is vulnerable to an integer overflow. By opening or inspecting a specially crafted .pyc file, an attacker can trigger a heap out-of-bounds write. This can lead to heap memory corruption and denial of service, with the potential for arbitrary code execution.
Last checked: 2026-09-25 18:57 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-22 17:54 UTC)
Exploit reference · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · View external evidence (Observed 2026-09-25 18:57 UTC)
Fix evidence last checked: 2026-09-23 11:19 UTC