CVE-2026-81882 radareorg CVE debrief

Who should care

Defenders responsible for radare2 installations, especially in environments where radare2 is used to process untrusted binary property-list data, should assess exposure and prioritize patching to version 6.2.0 or later.

Why it matters

Defenders should care about CVE-2026-81882 because it can lead to data disclosure and process termination in radare2 installations. The vulnerability requires verification of radare2 versions and application of the patch to prevent potential impacts.

• Potential disclosure of uninitialized or adjacent heap contents in JSON output
• Possible process termination due to reading beyond allocated memory

Technical summary

The radare2 binary property-list Unicode parser vulnerability occurs because the parser underallocates an uninitialized UTF-8 destination and does not guarantee NUL termination. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. Defenders should prioritize verifying and applying the patch to radare2 versions prior to 6.2.0, especially in environments where radare2 is used to process untrusted binary property-

Defensive priority

Defenders should prioritize verifying and applying the patch to radare2 versions prior to 6.2.0, especially in environments where radare2 is used to process untrusted binary property-list data.

Recommended defensive actions

• Verify radare2 version and apply patch to versions prior to 6.2.0
• Restrict use of radare2 to trusted binary property-list data
• Monitor for potential process termination and data disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.