CVE-2026-81883 in radare2
Summary
by MITRE • 09/22/2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in radare2, a widely used UNIX-like reverse engineering framework and command-line toolset, stems from an improper input validation mechanism within its Lua 5.3 bytecode function parser. Specifically, prior to version 6.2.0, the parser exhibited a critical flaw where it attempted to read fixed metadata fields immediately following a function-name string without verifying that sufficient data remained in the input buffer. This design oversight means that if a crafted Lua 5.3 bytecode file is provided wherein the function-name string extends exactly to or near the end of the allocated input buffer, the parser will proceed to access memory locations beyond the bounds of the valid data structure. The specific fields accessed include two integers and three one-byte fields, which are read from unallocated or out-of-bounds memory regions relative to the intended buffer scope.
From a technical perspective, this behavior constitutes an Out-of-Bounds Read vulnerability, commonly classified under CWE-125 in industry standards for software weaknesses. The root cause lies in the lack of boundary checks before performing sequential reads on structured data within the bytecode file. When the parser encounters a function definition, it assumes that all subsequent metadata fields are present and accessible within the current buffer limits. However, when an attacker crafts a malicious input where the string terminator or end-of-file marker coincides with the expected start of these metadata fields, the application attempts to dereference memory addresses outside its allocated space. This scenario is particularly dangerous in reverse engineering tools because they often process untrusted binary inputs from various sources without rigorous sanitization at every parsing stage.
The operational impact of this vulnerability primarily involves stability and availability rather than confidentiality or integrity in most observed cases. The immediate consequence of triggering this flaw is the generation of invalid parser results, which can lead to incorrect analysis outputs within radare2. More severely, it can cause process termination due to segmentation faults or access violations when the operating system detects an illegal memory access attempt. While no attacker-observable memory disclosure has been demonstrated in public reports, indicating that sensitive data from adjacent memory regions is not reliably exfiltrated through this specific vector, the potential for denial of service remains significant. An adversary could exploit this condition to crash the radare2 process during routine inspection or opening of maliciously crafted Lua bytecode files, thereby disrupting reverse engineering workflows and potentially causing downtime in automated analysis pipelines that rely on this toolset.
This vulnerability aligns with ATT&CK technique T1059, specifically regarding command-line interface abuse, as it involves manipulating input to a system utility to cause disruption. It also reflects broader principles related to CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Read, highlighting the necessity of strict boundary checks in parsers that handle structured binary data. The absence of length verification before reading fixed-size fields is a common pitfall in low-level parsing logic, emphasizing the need for defensive programming practices where every read operation must be preceded by an assertion of available buffer space.
Mitigation strategies focus primarily on software updates and input validation enhancements. Users running versions prior to 6.2.0 are strongly advised to upgrade to version 6.2.0 or later, as this release includes the necessary fixes to ensure that boundary checks are performed before accessing metadata fields following function names. For organizations integrating radare2 into automated security analysis pipelines, it is crucial to implement sandboxing or resource limits around the execution of such tools to contain potential crashes and prevent them from affecting host system stability. Additionally, developers should review other parsing routines within the framework for similar patterns where fixed-size reads are performed without explicit length validation against the remaining buffer size, ensuring comprehensive protection against out-of-bounds access vulnerabilities across all supported bytecode formats.