CVE-2026-81882
Received Received - Intake

Heap Buffer Overflow in radare2 Unicode Parser

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-81882
EUVD
EUVD-2026-84470

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
radare2 radare2 to 6.1.9 (exc)
radare2 radare2 to 6.1.8 (inc)
radare2 radare2 6.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-170 The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in radare2's binary property-list (bplist) Unicode parser. It occurs when converting UTF-16 strings to UTF-8 without proper buffer allocation or null termination. The parser underallocates memory and fails to ensure NUL termination, causing the JSON encoder to read beyond the buffer when processing untrusted data via pFB or pFBj commands.

Detection Guidance

To detect this vulnerability, check if your radare2 version is prior to 6.2.0. Run 'r2 -v' to see the installed version. If vulnerable, running 'pFB' or 'pFBj' commands on untrusted binary property-list data may trigger the issue.

Impact Analysis

The vulnerability can lead to disclosure of uninitialized heap memory or process termination. Attackers could exploit it to read sensitive data from memory or crash the application when processing malicious bplist data. Exploitation requires user interaction to run specific commands on untrusted files.

Mitigation Strategies

Upgrade radare2 to version 6.2.0 or later. Avoid using 'pFB' or 'pFBj' commands on untrusted data until patched. Monitor for crashes or memory leaks when processing binary property-list files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart