CVE-2026-22780: 
NixOS vulnerability analysis and mitigation

CVE-2026-22780 is a heap overflow vulnerability in Rizin, a UNIX-like reverse engineering framework and command-line toolset, affecting all versions prior to 0.8.2. The flaw exists in the mach0 file parser and can be triggered when a maliciously crafted Mach-O binary with bogus dyld chained segment entries is analyzed. It was reported on January 10, 2026, and publicly disclosed on February 1–2, 2026, with a fix released in version 0.8.2. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, though the GitHub Security Advisory rates it 4.4 (Moderate) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of the maximum iteration count (max_count) in the parse_chained_fixups function within librz/bin/format/mach0/mach0_chained_fixups.c. Specifically, at line 200, the code used RZ_MAX(bin->nsegs, cf->starts_count) to determine the loop bound, which could exceed the size of the allocated cf->starts array (allocated based on cf->starts_count) when bin->nsegs is larger. A crafted Mach-O file can set cf->starts_count to 0 (causing a zero-byte allocation) while the loop iterates up to bin->nsegs, resulting in a heap-based out-of-bounds write of size 8. The fix (PR #5770) corrects this by using min(bin->nsegs, cf->starts_count) instead of max. CWEs assigned include CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-131 (Incorrect Calculation of Buffer Size) (GitHub Commit, GitHub Issue).

Successful exploitation causes a heap-based out-of-bounds write, which can crash the Rizin application (denial of service) and potentially corrupt heap memory in ways that could affect data integrity. The GitHub advisory notes low integrity and availability impact with no confidentiality impact, while the Red Hat Bugzilla entry describes the potential for arbitrary code execution via the malicious Mach-O file. Exploitation is limited to local attack vectors and requires a user to open a crafted file, constraining the blast radius to the analyst's workstation or CI/CD pipeline running Rizin (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.004%, reflecting minimal likelihood of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must open a specially crafted Mach-O binary with Rizin — limiting opportunistic exploitation (GitHub Advisory, Feedly).

1. Craft malicious Mach-O file: Create a Mach-O binary with a LC_DYLD_CHAINED_FIXUPS load command where the starts_count field in the chained fixups header is set to 0 (or a very small value), while the number of segment entries (nsegs) in the binary is set to a larger value.
2. Trigger zero-byte allocation: When Rizin parses the file, cf->starts is allocated with size based on cf->starts_count (e.g., 0 bytes via calloc(0, ...)), resulting in a minimal or empty heap allocation.
3. Induce out-of-bounds write: The vulnerable loop iterates up to max(bin->nsegs, cf->starts_count) — i.e., up to bin->nsegs — writing pointers to cf->starts[i] beyond the allocated buffer boundary, corrupting adjacent heap memory.
4. Deliver the file: Distribute the crafted Mach-O binary to a target analyst or place it in a location where it will be automatically analyzed by Rizin (e.g., a CI/CD pipeline or automated malware analysis system).
5. Achieve impact: Depending on heap layout and platform mitigations, the result ranges from an application crash (DoS) to potential heap corruption that could be leveraged for further exploitation (GitHub Issue, GitHub Commit).

• Process: Rizin process (rizin) crashing or terminating abnormally with a segmentation fault or abort signal when opening a Mach-O file.
• Logs: AddressSanitizer output referencing heap-buffer-overflow in parse_chained_fixups at mach0_chained_fixups.c:214 if Rizin is compiled with ASan; core dump files generated by the Rizin process.
• File System: Presence of unexpected or suspicious Mach-O binaries (especially with unusual LC_DYLD_CHAINED_FIXUPS load commands and mismatched segment counts) in directories analyzed by Rizin.
• Network: Unusual inbound delivery of Mach-O files from untrusted sources to systems running Rizin for automated analysis (GitHub Issue).

The vulnerability is fixed in Rizin version 0.8.2. Users should upgrade immediately by following the official Rizin release process. As a workaround prior to patching, avoid opening Mach-O files from untrusted sources with Rizin, and restrict access to Rizin tooling to trusted users only. Where automated analysis pipelines use Rizin, implement file validation or sandboxing before parsing Mach-O binaries (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher xobx-cherif and credited in the GitHub Security Advisory. The Rizin maintainers responded promptly, merging the fix (PR #5770) and publishing the advisory on February 1, 2026. Red Hat tracked the issue via Bugzilla (Bug 2436123) and noted it as a medium-severity security response item. No significant broader media coverage or notable social media discussion has been observed beyond standard CVE aggregator activity (GitHub Advisory, Red Hat Bugzilla).