CVE Feed

    Dashboard / CVE / CVE-2026-4174

    CVE-2026-4174

    A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. Upgrading to version 6.1.2 is capable of addressing this issue. The name of the patch is 4371ae84c99c46b48cb21badbbef06b30757aba0. You should upgrade the affected component. The code maintainer states that, "[he] wont consider this bug a DoS".

    Published:Mar 15, 2026
    Last Modified:Apr 22, 2026
    EPS:Mar 15, 2026
    EPSS Score:0.00017
    CVSS Score:3.3

    Affected Products

    Vendor
    Radare
    Product
    Radare2

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-14760 (CVSS 1.9) — A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bit…
    CVE-2026-14758 (CVSS 1.9) — A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_a…
    CVE-2026-14757 (CVSS 1.9) — A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of …
    CVE-2026-8696 (CVSS 8.7) — radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client c…
    CVE-2026-8695 (CVSS 8.7) — radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote a…
    CVE-2026-6942 (CVSS 9.3) — radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attack…
    CVE-2026-6941 (CVSS 6.9) — radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attac…
    CVE-2026-6940 (CVSS 6.9) — radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers…
    CVE-2026-40517 (CVSS 8.4) — radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function t…
    CVE-2026-40527 (CVSS 8.5) — radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path wher…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High