CVE-2026-31053

Executive Summary

CVE-2026-31053 is a double-free vulnerability in radare2's binary parsing library, identified in the le_load_fixup_record() function within librz/bin/format/le/le.c. Specifically, the flaw resides in the module's handling of malformed or circular Linear Executable (LE) file fixup chains, where multiple dereference operations followed by improper cleanup result in double memory deallocation. Organizations integrating radare2 into automated malware triage pipelines, sandboxes, or CI/CD security tooling are at increased risk, as a maliciously crafted LE binary could trigger heap corruption and crash the process, causing a denial-of-service condition. The impact is confined to availability, with no evidence of remote code execution or data exfiltration currently identified. Patch verification is at a claimed stage (2/4 confidence) with a single OSV-recorded source indicating a fix, but no official radare2 advisory has been independently confirmed at the time of writing.

Technical Analysis

The vulnerability resides in the parsing of Linear Executable (LE) format binaries, a legacy format primarily associated with 16-bit and 32-bit OS/2 and early Windows executables. The affected function, le_load_fixup_record(), is responsible for processing fixup records—structures that contain addressing adjustments applied to the executable's relocation table at load time.

Mechanism of the Double-Free:

1. Fixup chain traversal: The function iterates through a linked-list-style chain of fixup entries extracted from the binary's fixup section. Each entry contains offsets, target selectors, and type information.

2. Malformed base case handling: When the parser encounters a malformed entry—such as a corrupted offset pointing outside the declared number of fixups—it enters an error-handling branch that attempts to release allocated memory for previous entries in the chain.

3. Circular reference triggering: A specifically crafted LE binary can construct a fixup chain where an entry's next-pointer references itself or a prior entry, creating a cycle. During error recovery, the cleanup routine free() is invoked on a memory region already freed in a prior iteration of the error path.

4. Double-free consequence: The second free() call on the same heap chunk triggers undefined behavior in glibc's ptmalloc allocator, leading to heap metadata corruption, potential arbitrary write primitives in complex scenarios, and typically an immediate segmentation fault (SIGSEGV) or abort due to detected double-free via MALLOC_CHECK_.

Attack Surface:

• File parsing interfaces: The vulnerability is reachable whenever radare2's r_bin subsystem processes a LE format file—via radare2 <file>, r2 -A <file>, or through the library's Python/Rust bindings.
• Automated pipelines: Security tools that feed untrusted binaries into radare2 for automated reverse engineering, symbol extraction, or entropy analysis are the highest-risk integrations.
• User interaction: A remote attacker must deliver the crafted binary to a system where an operator or an automated service executes radare2 against it. This is not a remote code execution vector unless additional heap-exploitation primitives are developed.

Code-level context: The fault occurs in the error-handling logic rather than the core loop. Standard memory management hygiene would require a "cleanup once, then mark as freed" pattern; the absence of such a guard is the root cause.

Exploitation Scenarios

Even without a public PoC, the attack chain is well-defined for an attacker targeting a service pipeline that processes untrusted binary files.

Attack Chain Steps:

1. Target identification and reconnaissance:

   • The attacker profiles an organization's security automation stack—looking for publicly documented use of radare2 in malware sandboxes, plugin-based IDA alternatives, or CI pipelines that import radare2 for binary analysis tasks.
   • Identifies API endpoints or upload interfaces (e.g., a web-hosted binary analysis tool, an email gateway that scans attachments via radare2) that accept executable files without strict extension validation.

2. Weaponization of the binary:

   • The attacker crafts a valid LE binary using an available LE assembler tool or by binary-patching a stub OS/2 executable (obtained from legacy software archives).
   • Calculates the LE header offset for the fixup section and constructs a fixup record with a self-referential pointer. Example: Fixup entry at offset 0x1C contains a next_fixup_offset field set to 0x1C, and a type field set to an invalid value (e.g., TYPE_INVALID=0xFF) to trigger the error path.
   • Validates the binary locally using radare2 --version and r2 -c 'aaa' crash_test.le to confirm the crash (segmentation fault).

3. Delivery and execution:

   • Attacker submits the crafted .le file through the target's file upload/scanning interface, or emails it as an attachment to a victim mailbox monitored by an email security gateway that uses radare2 for attachment analysis.
   • The target system's automation invokes radare2, which begins parsing the LE file; the fixup loop enters the error handler; the double-free triggers a crash.

4. Post-exploitation impact:

   • Primary impact is denial-of-service: the radare2 process terminates, causing the sandbox analysis to fail, potentially killing the queue of pending samples (if the pipeline is single-threaded and lacks exception isolation).
   • In a CI/CD context, the crash causes a pipeline failure, blocking software releases until manual intervention.
   • If the radare2 process is a component of a larger containerized microservice, orphaned container restarts may occur, causing cascading instability.
   • Note: If the vulnerability were chained with a heap feng-shui primitive (e.g., a controlled allocation size via other fixup parameters), a determined attacker could attempt to gain arbitrary code execution within the context of the radare2 process—this is speculative pending further research but is a realistic evolution.

Impact Assessment

CVSS Context: With a base score of N/A, we rely on qualitative analysis. The vector characteristics align with a local, low-complexity attack requiring user interaction (opening a file) or a network trigger only insofar as the crafted file must be delivered. Using comparable published CVEs for similar double-free file-parsing flaws (e.g., CVEs in libmagic), an estimated CVSS v3.1 vector would be: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Medium severity, ~5.5).

Business Impact:

• Availability: The primary measured impact. Enterprises running radare2 at scale (e.g., automated file classification in SOAR platforms) may experience queue saturation and delayed threat detection during a targeted attack.
• Data Integrity: No data corruption or tampering of analysis results is expected unless the heap corruption writes into process memory used for output generation—a low-probability scenario.
• Confidentiality: No direct confidentiality breach.

Affected Systems:

• All platforms where radare2 (and the underlying rz_bin/librz codebase, now maintained as a separate rizin project) builds—Linux, Windows, macOS, *BSD.
• Custom integrations using rz_bin Python bindings (rzpipe) or the C API.
• IoT devices and embedded routers that package radare2 for firmware strings-style analysis.

Blast Radius: Moderate—the vulnerability is reachable only via binary analysis workflows, which are niche but security-critical. It does not affect radare2's use as a disassembler on already-parsed buffers unless the LE parser is invoked.

Detection Guidance

Sigma Rule

title: Possible Double-Free Exploitation via Malformed LE Binary in radare2
id: 8f3c9e54-7a11-4fc2-8db3-0e91b1c9f442
status: experimental
description: Detects crashes or error output in radare2 processes when processing LE-format binary files, potentially indicative of CVE-2026-31053 exploitation attempts.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31053
author: Valters IT Threat Intelligence
date: 2026/02/08
logsource:
    category: process_creation
    product: linux
detection:
    selection_syslog:
        EventID: 5
        Channel: Security
    selection_process:
        Image|endswith: '\radare2'
    selection_crash:
        CommandLine|contains:
            - 'segmentation fault'
            - 'core dumped'
            - 'abort'
    condition: selection_process and selection_crash
level: high
falsepositives:
    - Legitimate crash of radare2 due to other malformed file formats
    - Operating system signal output unrelated to this specific CVE

YARA Rule

rule LE_Fixup_DoubleFree_CVE_2026_31053 {
    meta:
        author = "Valters IT"
        description = "Detects LE binaries with suspicious self-referential fixup entries potentially triggering a double-free in radare2's le_load_fixup_record()"
        reference = "CVE-2026-31053"
        date = "2026-02-08"
        severity = "high"
    strings:
        $le_magic = { 4C 45 } // 'LE' magic bytes
        $fixup_page_offset_32 = /{ 00 00 [\x00-\xff]{4} 00 00 }/ // Heuristic: entry with 4-byte zeroed fields
        $invalid_type_ff = { FF FF } // Possible invalid fixup type marker
        $self_ref_16 = { (?? ?? ?? ?? ?? ?? 00 00) } // Ambiguous—used only as heuristic
    condition:
        uint16(0) == 0x454C and
        filesize > 512 and
        $le_magic at 0 and
        #fixup_page_offset_32 >= 1 and
        $invalid_type_ff
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"Possible LE binary transfer targeting radare2 analysis pipeline"; flow:established,to_server; content:"LE"; nocase; distance:0; within:2; content:"|00 00|"; distance:16; within:2; classtype:attempted-dos; sid:20263105; rev:1; reference:cve,2026-31053;)

Note: Network-level detection is inherently limited because the attack manifests only during file parsing. This rule flags ingress of a file with LE magic bytes; apply it on file-transfer protocols (SMTP, HTTP upload, SMB).

Elastic Detection

// EQL for Windows Event 1001 (crash) or Linux auditd
sequence by host.name with maxspan=5m
  [process where process.name == "radare2" and event.action == "exec"] 
  [process where process.name == "radare2" and event.type == "end" and process.exit_code == 139]

Alternatively, for a containerized context:

// EQL for Kubernetes container restart storms
sequence by container.name with maxspan=10m
  [kubernetes where kubernetes.pod.name == "*radare2*" and event.action == "container_started"]
  [kubernetes where kubernetes.pod.name == "*radare2*" and event.action == "container_exited" and kubernetes.exit_code == 139]

Splunk SPL Query

index=process sourcetype=ProcessRollup2 OR sourcetype=linux_audit
| search "radare2"
| rex field=command_line ".*(?<input_file>\w+\.(le|exe|bin)).*"
| join type=inner input_file [ search index=syslog sourcetype=linux_messages
    | rex ".*(?<segv>segfault|core dumped|abort).*" 
    | rename name as input_file ]
| stats count by host, input_file, segv, _time
| where count > 0
| table _time, host, input_file, segv, count

Wazuh OSSEC Rule

<group name="radare2_abuse,">
  <rule id="100310" level="10">
    <decoded_as>syslog</decoded_as>
    <field name="program">kernel</field>
    <match>segfault</match>
    <regex>radare2</regex>
    <description>Potential double-free exploitation (CVE-2026-31053): radare2 process experienced a segmentation fault while processing a file.</description>
    <group>local_security,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence assessment: 2/4 (CLAIMED). A single OSV record indicates a fix exists, but the vendor advisory and diff details are not independently confirmed. Verify the patch before deployment.

1) Immediate mitigations (apply now):

• Input validation: If radare2 is used in an automated pipeline, add a pre-parse validation layer that verifies the LE header's fixup table offset and count fields are within the physical file size before invoking radare2. Reject files with disklaimer inconsistencies.
• Sandbox isolation: Execute radare2 in a disposable container (e.g., docker run --rm --read-only --memory=256m --pids-limit=1) so that a crash does not affect the host or other analysis tasks.
• Process supervision: Wrap invocation with a supervisor (systemd, supervisord) configured to restart on crash and alert on high exit-code frequency.

2) Patch/upgrade steps:

• Check for a patched release from the radare2 project (target version: 5.9.0 or later, if released) or the rizin project for the rz_bin fork.
• If the OSV-recorded patch applies to the librz package within a Linux distribution, apply the distribution's security update:
  • Debian/Ubuntu: sudo apt update && sudo apt install librz-dev izin
  • Fedora/RHEL: sudo dnf update rizin
• If building from source, apply the upstream commit referenced by OSV and rebuild with ./configure && make && sudo make install.

3) Long-term hardening:

• Upgrade to the rizin project, which is the actively maintained fork of radare2's analysis backend; it has a dedicated security response process.
• Standardize on a binary-format firewall (e.g., ClamAV with LE heuristics enabled) at the perimeter to pre-filter suspicious PE/LE files.
• Incorporate fuzzing of your analysis toolchain into your DevSecOps pipeline using AFL++ or libFuzzer with a corpus of LE/NE/MZ files to catch regression of this class of bugs.
• Implement memory-safe allocator options where possible (e.g., glibc.malloc.check=3, or use of Electric Fence in non-production test environments).

References

1. NVD Entry: CVE-2026-31053 — Official NVD description and environmental metrics.
2. OSV Advisory: OSV for CVE-2026-31053 — Patch claim source (though not yet independently confirmed).
3. radare2 Project Site: radare.org — Vendor project information; verify for security advisories section.
4. LE Format Specification: Microsoft OS/2 Programmer's Reference, Chapter on "Linear Executable Format" — background for understanding fixup chains.
5. No CISA KEV entry exists (NO status), and no threat-actor campaigns or exploit-in-the-wild evidence has been reported at this time.

Report compiled by Valters IT Threat Intelligence — 2026-02-08.