Log in Start free

Vulnerability · Published Mar 15, 2026 · Assigned by VulDB

CVE-2026-4174Radare2 Mach-O File mach0.c walk_exports_trie resource consumption

Low 3.3

In plain English

A low-severity uncontrolled resource consumption in Radare2. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. Upgrading to version 6.1.2 is capable of addressing this issue. The name of the patch is 4371ae84c99c46b48cb21badbbef06b30757aba0. You should upgrade the affected component. The code maintainer states that, "[he] wont consider this bug a DoS".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:25.10radare2no fix listedUBUNTU-CVE-2026-4174
Ubuntu:26.04:LTSradare2no fix listedUBUNTU-CVE-2026-4174
Ubuntu:26.10radare2no fix listedUBUNTU-CVE-2026-4174

Affected products (as reported)

VendorProductVersions
n/a Radare2 5.9.9

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References