CVE-2026-81882: radare2 Information Disclosure Vulnerability

CVE-2026-81882 Overview

CVE-2026-81882 is an out-of-bounds read vulnerability in radare2, a UNIX-like reverse engineering framework and command-line toolset. Versions prior to 6.2.0 contain a flaw in the binary property-list (bplist) Unicode parser. The parser underallocates an uninitialized UTF-8 destination buffer and does not guarantee NUL termination. When a user runs the pFB or pFBj commands against untrusted bplist data, the JSON encoder treats the converted data as a NUL-terminated C string and reads beyond the allocation. This can disclose uninitialized or adjacent heap contents through JSON output and may terminate the analyst's radare2 process.

Critical Impact
Analysts who open untrusted bplist artifacts with pFB/pFBj risk heap memory disclosure and process crash [CWE-125].

Affected Products

radare2 reverse engineering framework, all versions prior to 6.2.0
The libr/util/bplist.c component, specifically parse_unicode_node
Downstream tooling that embeds radare2 and exposes the pFB or pFBj print commands

Discovery Timeline

2026-09-22 - CVE-2026-81882 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-81882

Vulnerability Analysis

The vulnerability resides in parse_unicode_node() in libr/util/bplist.c. The function converts a UTF-16 encoded Unicode node inside a binary property list to UTF-8 before handing the result to radare2's JSON encoder. The original implementation allocated a destination buffer sized as size + 1 bytes and invoked r_str_utf16_to_utf8(dst, size, src, size, false). UTF-8 encodings of BMP code points can require up to three bytes per source code unit, so the destination buffer is too small for the worst-case conversion, and the routine never writes a terminating NUL byte.

When the JSON encoder later serializes this buffer, it treats the memory as a C string and continues reading past the allocation until it encounters an arbitrary NUL byte in adjacent heap memory. The out-of-bounds read exposes uninitialized allocator metadata or neighboring heap contents in the JSON output and can trigger a process-terminating fault when the read crosses an unmapped page boundary.

Root Cause

The root cause is an undersized allocation combined with missing termination [CWE-125]. The parser assumed a 1:1 byte ratio between UTF-16 input and UTF-8 output, ignored the possibility of multi-byte UTF-8 sequences, and relied on the conversion routine to implicitly terminate the buffer. Neither assumption holds.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a malicious binary property-list file and convinces a reverse engineer to load it in radare2 and issue pFB or pFBj. The attacker does not gain code execution, but harvests heap memory contents from JSON output or forces the analyst's session to crash.

// Security patch in libr/util/bplist.c (parse_unicode_node)
// Source: https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45
 static bool parse_unicode_node(RBPlist *bplist, const char **bnode, ut64 size) {
-	ut8 *dst = malloc (size + 1);
+	if (size > (ut64)ST32_MAX / 3) {
+		R_LOG_ERROR ("BPLIST_UNICODE data size is too large");
+		return false;
+	}
+	int src_size = (int)(size * 2);
+	int dst_size = (int)(size * 3) + 1;
+	ut8 *dst = malloc (dst_size);
 	if (!dst) {
 		return false;
 	}
 	const ut8 *src = (const ut8*)*bnode;
-	if (!r_str_utf16_to_utf8 (dst, size, src, size, false)) {
+	if (r_str_utf16_to_utf8 (dst, dst_size, src, src_size, false) < 0) {
 		free (dst);
 		return false;
 	}

The patch enforces a maximum input size, allocates three bytes per source code unit plus one for the NUL terminator, and treats the conversion routine's negative return as an error condition.

Detection Methods for CVE-2026-81882

Indicators of Compromise

Radare2 process crashes or segmentation faults recorded shortly after issuing pFB or pFBj commands.
JSON output from pFBj that contains unexpected binary noise, non-UTF-8 byte sequences, or trailing garbage after Unicode fields.
Bplist artifacts of unknown provenance staged alongside reverse engineering projects or shared through untrusted channels.

Detection Strategies

Inventory analyst workstations and identify installed radare2 versions below 6.2.0.
Audit shell history and radare2 project files for invocations of pFB or pFBj against externally sourced binaries.
Hunt for core dumps or crash telemetry attributed to the radare2 or r2 binary on developer and reverse engineering endpoints.

Monitoring Recommendations

Monitor endpoint telemetry for repeated crashes of r2, radare2, or embedding tools that link against libr_util.
Track file transfers of .bplist and Apple property-list artifacts onto analyst systems and correlate with subsequent radare2 execution.
Alert on process termination events for reverse engineering tooling that coincide with new bplist file access.

How to Mitigate CVE-2026-81882

Immediate Actions Required

Upgrade radare2 to version 6.2.0 or later on every workstation, build agent, and container image where it is installed.
Refrain from running pFB or pFBj against untrusted or attacker-supplied binary property-list data until the upgrade is complete.
Rebuild and redistribute downstream tools that vendor or statically link libr/util/bplist.c from an affected radare2 release.

Patch Information

The issue is fixed in radare2 6.2.0 through commit 38d82a949626dba3783f40508bb66179e631fa45. See the GitHub Security Advisory GHSA-r5cr-f9p6-5pvj, the radare2 6.2.0 release notes, and issue #26227 for additional context.

Workarounds

Analyze untrusted bplist samples inside an isolated virtual machine or sandbox with no sensitive data in memory.
Convert bplist artifacts to XML with a separate tool such as plutil -convert xml1 before opening them in radare2.
Disable or wrap the pFB and pFBj commands in analyst tooling to require explicit confirmation on untrusted input.

bash

# Upgrade radare2 from source to a fixed release
git clone https://github.com/radareorg/radare2.git
cd radare2
git checkout 6.2.0
sys/install.sh
r2 -v   # confirm the reported version is 6.2.0 or later