CVE-2026-81883

Katalog CVE

CVSS 3.3 · Low EPSS 0,16%

Kerentanan Out-of-bounds Read pada radare2. Skor CVSS 3.1 3.3 (Low) menurut github.com.

Deskripsi (NVD)

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/radareorg/radare2/issues/26228 exploit · issue tracking · mitigasi · advisory vendor
• https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c patch · advisory vendor
• https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3 patch
• https://github.com/radareorg/radare2/releases/tag/6.2.0 release notes