CVE-2026-81882

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81882
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81882.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81882
Aliases
  • GHSA-r5cr-f9p6-5pvj
Downstream
Published
2026-09-22T15:12:49Z
Modified
2026-09-24T08:34:25Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser
Details

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-170"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81882.json"
}
References

Affected packages

Git / github.com/radareorg/radare2

Affected ranges

Type
GIT
Repo
https://github.com/radareorg/radare2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38d82a949626dba3783f40508bb66179e631fa45
Fixed
e1fc278734ad62f933fc6f91edb29e4ba732f402
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.2.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.4-termux4
0.10.5
0.10.6
0.8.6
0.8.8
0.9
0.9.2
0.9.4
0.9.6
0.9.7
0.9.8
0.9.8-rc1
0.9.8-rc2
0.9.8-rc3
0.9.8-rc4
0.9.9
1.*
1.0
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.0-git
1.3.0
1.3.0-git
1.4.0
1.5.0
1.6.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.4.0
2.5.0
2.6.0
2.6.9
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.3.1
4.4.0
4.5.1
5.*
5.0.0
5.1.0
5.1.1
5.2.0
5.2.1
5.3.0
5.3.1
5.4.0
5.4.0-git
5.4.2
5.5.0
5.5.2
5.5.4
5.6.0
5.6.2
5.6.4
5.6.6
5.6.8
5.7.0
5.7.2
5.7.4
5.7.6
5.7.8
5.8.0
5.8.2
5.8.4
5.8.6
5.8.8
5.9.0
5.9.2
5.9.4
5.9.6
5.9.8
6.*
6.0.0
6.0.2
6.0.4
6.0.6
6.0.7
6.0.8
6.1.0
6.1.2
6.1.4
6.1.6
6.1.8
Other
Continuous-Windows
continuous
radare2-windows-nightly
termux
wip
release-5.*
release-5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81882.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "60453930383395516139907255464558429164",
                "53016502880587424000635722881178750746",
                "138162268501879642892024926370016602091",
                "42871337215623446537473188963664157117",
                "73668069805902644505064035644344549985",
                "20574016968956808781197037269461170575",
                "102605578548619322598464287833045857832",
                "313943388047227178744820006027245821711",
                "73042776375999805283744976565983840239"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-81882-4ce80562",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45",
        "target":  {
            "file":  "libr/util/bplist.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "18062602635076863756414524163696404992",
            "length":  378
        },
        "id":  "CVE-2026-81882-c2f5d896",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45",
        "target":  {
            "file":  "libr/util/bplist.c",
            "function":  "parse_unicode_node"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:34:25Z"