CVE-2026-81883: radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of radare2 versions before 6.2.0 are exposed when they open or inspect untrusted Lua 5.3 bytecode files. Exploitation requires local access and user interaction with a crafted file.
What happens if exploitation succeeds?
The parser can read beyond the allocated input buffer, causing invalid parsing results or termination of the radare2 process. No attacker-observable memory disclosure has been demonstrated.
What should teams do if they cannot upgrade immediately?
Avoid opening or inspecting untrusted Lua 5.3 bytecode files with affected radare2 versions. Upgrade to version 6.2.0 when possible.