A flaw was found in radare2. A remote attacker could exploit a heap out-of-bounds read vulnerability in the Mach-O LC_DATA_IN_CODE parser. This occurs when opening a specially crafted Mach-O file with the non-default `bin.verbose` option enabled, leading to a read beyond the allocated buffer. This vulnerability can result in possible process termination, causing a Denial of Service (DoS).
Last checked: 2026-09-28 15:29 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-22 15:39 UTC)
Exploit reference · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · View external evidence (Observed 2026-09-28 15:29 UTC)
Fix evidence last checked: 2026-09-23 11:19 UTC