CVE catalog
CVE-2026-81882
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode par
- Severity
- Low · CVSS 3.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.17% · Oct 25, 2026
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | radare2 | Not reported | 6.2.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | radare2 | cpe | Not reported | 6.2.0 | Not reported | NVD-CVE-2026-81882 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21988-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-81882]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81882.json]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]