CVE-2026-81882 in radare2
Summary
by MITRE • 09/22/2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
radare2 serves as a comprehensive UNIX-like reverse engineering framework and command-line toolset, widely utilized by security researchers for binary analysis and disassembly. Within this ecosystem, the handling of binary property lists represents a critical component for parsing structured data embedded within executables or configuration files. Prior to version 6.2.0, the internal parser responsible for processing Unicode-encoded binary property lists contained a significant memory safety flaw that compromised the integrity of heap operations during data conversion processes.
The core technical vulnerability stems from an improper allocation strategy combined with insufficient string termination guarantees in the UTF-8 destination buffer. When the parser processed specific inputs, it underallocated the memory required to hold the converted Unicode text and failed to ensure NUL termination of the resulting string. This oversight created a scenario where subsequent operations assumed standard C-string behavior without verifying bounds or initialization status. Specifically, when users executed commands such as pFB or pFBj on untrusted binary property-list data, the system attempted to process this malformed input through the flawed parsing routine.
The operational impact of this flaw is most pronounced in JSON output scenarios due to how the json encoder handled the converted data. The encoder treated the improperly allocated and uninitialized UTF-8 buffer as a standard NUL-terminated C string. Because the memory was not fully initialized and lacked explicit termination, the encoding function continued reading beyond the bounds of the allocated heap region. This out-of-bounds read operation resulted in the disclosure of sensitive information contained within adjacent heap memory or previously used uninitialized data structures. Such leakage can expose internal state variables, pointers, or other confidential artifacts to an attacker who controls the input binary property list.
Furthermore, this vulnerability poses a risk to process stability and availability. The act of reading beyond allocated boundaries can trigger segmentation faults or access violations depending on the operating system's memory protection mechanisms, leading to unexpected process termination. This constitutes a denial-of-service condition for systems relying on radare2 for automated analysis pipelines where untrusted inputs might be processed without rigorous pre-validation.
From a classification perspective, this vulnerability aligns with CWE-134: Use of Externally-Controlled Format String and more accurately CWE-787: Out-of-bounds Write or Read depending on the specific memory state at exploitation time, though primarily it is an out-of-bounds read leading to information disclosure. In terms of attack vectors, this falls under ATT&CK technique T1059 Command and Scripting Interpreter if leveraged within a broader exploit chain, but fundamentally represents CWE-20: Improper Input Validation regarding the handling of external binary data structures.
To mitigate this risk, organizations utilizing radare2 must ensure that all instances are upgraded to version 6.2.0 or later where these memory management issues have been resolved by enforcing proper buffer allocation sizes and guaranteeing NUL termination for string operations. Additionally, when processing untrusted binaries in production environments, it is advisable to implement sandboxed execution contexts to limit the potential impact of any residual vulnerabilities. Input validation strategies should also be employed at higher-level application layers to filter or sanitize binary property lists before they reach the parsing engine, thereby reducing the attack surface for memory corruption flaws.