Crash and memory disclosure via unchecked symbol-cache bounds

Out-of-bounds reads in radare2 before 5.6.8 allow attackers to disclose process memory or crash the application via a crafted file. The Mach-O core symbolication parser's r_coresym_cache_element_new function reads word-sized fields after checking only whether its cursor reached the buffer end, and it uses a section-name offset without first validating that offset. Exploitation requires an affected user to open or inspect a crafted binary, limiting the demonstrated consequences to memory disclosure and process termination.