CVE-2026-81882 (GCVE-0-2026-81882)
Vulnerability from cvelistv5
Published
2026-09-22 15:12
Modified
2026-09-28 16:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81882",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T16:08:12.373700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:32:29.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "radare2",
"vendor": "radareorg",
"versions": [
{
"status": "affected",
"version": "\u003c 6.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2\u0027s binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-170",
"description": "CWE-170: Improper Null Termination",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:12:49.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj"
},
{
"name": "https://github.com/radareorg/radare2/issues/26227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/radareorg/radare2/issues/26227"
},
{
"name": "https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45"
},
{
"name": "https://github.com/radareorg/radare2/releases/tag/6.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
}
],
"source": {
"advisory": "GHSA-r5cr-f9p6-5pvj",
"discovery": "UNKNOWN"
},
"title": "radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81882",
"datePublished": "2026-09-22T15:12:49.907Z",
"dateReserved": "2026-08-27T17:48:42.122Z",
"dateUpdated": "2026-09-28T16:32:29.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-81882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-28T16:08:12.373700Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-28T16:22:40.883Z\"}}], \"cna\": {\"title\": \"radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser\", \"source\": {\"advisory\": \"GHSA-r5cr-f9p6-5pvj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"radareorg\", \"product\": \"radare2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.2.0\"}]}], \"references\": [{\"url\": \"https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj\", \"name\": \"https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/radareorg/radare2/issues/26227\", \"name\": \"https://github.com/radareorg/radare2/issues/26227\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45\", \"name\": \"https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/radareorg/radare2/releases/tag/6.2.0\", \"name\": \"https://github.com/radareorg/radare2/releases/tag/6.2.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2\u0027s binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125: Out-of-bounds Read\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-170\", \"description\": \"CWE-170: Improper Null Termination\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-22T15:12:49.907Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-81882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-28T16:32:29.291Z\", \"dateReserved\": \"2026-08-27T17:48:42.122Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-22T15:12:49.907Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…