Unicode Parser Vulnerability in radare2 Reverse Engineering Tool by radareorg

CVE-2026-81882

What is CVE-2026-81882?

Prior to version 6.2.0, the radare2 reverse engineering framework featured a vulnerability in its binary property-list Unicode parser. This issue stemmed from improper handling of uninitialized UTF-8 destination arrays, which led to the binary property-list parser underallocating memory. When commands like pFB or pFBj were executed on untrusted data, the json encoder mismanaged the output, treating converted data as null-terminated strings. This flaw could result in the disclosure of uninitialized or adjacent heap contents in the JSON output, potentially resulting in unintended process termination. This vulnerability has been rectified in version 6.2.0.

References