CVE-2026-81882 radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
An attacker can disclose heap memory or crash the application by providing malicious binary property-list data to radare2's parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-81882?
CVE-2026-81882 is a low-severity vulnerability in Radare Radare2, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
Which versions are affected by CVE-2026-81882?
It affects 1 product.
Products include Radare Radare2.
How do I fix CVE-2026-81882?
Upgrade to a fixed version.
Is CVE-2026-81882 being exploited?
There is no known exploitation of CVE-2026-81882 in the wild and no public exploit code.
Other vulnerabilities in Radare Radare2
Sources
Also known as GHSA-r5cr-f9p6-5pvj, UBUNTU-CVE-2026-81882.