6.1

CVE-2026-81882

Exploit

radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Radare ≫ Radare2 Version < 6.2.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.067
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 1.8 4.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
security-advisories@github.com 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-170 Improper Null Termination

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

https://github.com/radareorg/radare2/releases/tag/6.2.0
Release Notes
https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj
Patch
Vendor Advisory
https://github.com/radareorg/radare2/issues/26227
Vendor Advisory
Exploit
Issue Tracking
Mitigation
https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45
Patch