CVE-2026-81882: radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Which installations are affected?
radare2 versions prior to 6.2.0 are affected. The issue is fixed in version 6.2.0.
What must an attacker or user do to trigger the issue?
The vulnerable binary property-list Unicode parsing path is triggered when the explicit pFB or pFBj command is run on untrusted binary property-list data. The supplied vector requires local access and user interaction.
What could happen if the issue is triggered?
JSON output may disclose uninitialized or adjacent heap contents because converted data can be read past its allocation. The radare2 process may also terminate.
What can be done if upgrading is not immediately possible?
Do not run the explicit pFB or pFBj commands on untrusted binary property-list input until radare2 can be upgraded to 6.2.0 or later.