CVE-2026-81883: radare2 Lua Parser Buffer Overflow Flaw

CVE-2026-81883 Overview

CVE-2026-81883 is an out-of-bounds read vulnerability [CWE-125] in radare2, a UNIX-like reverse engineering framework and command-line toolset. The flaw resides in the Lua 5.3 bytecode function parser located in libr/bin/format/lua/lua.c. Prior to version 6.2.0, the parser reads fixed function-metadata fields immediately after a function-name string without validating the remaining buffer length. An analyst opening or inspecting a crafted Lua 5.3 bytecode file can trigger the read past the allocated input buffer. The vulnerability was fixed in radare2 version 6.2.0.

Critical Impact
Local user interaction with a crafted Lua bytecode file causes invalid parser output or process termination. No attacker-observable memory disclosure has been demonstrated.

Affected Products

radare2 versions prior to 6.2.0
Downstream tools and distributions bundling vulnerable radare2 releases
Automated malware analysis pipelines that ingest untrusted Lua bytecode via radare2

Discovery Timeline

2026-09-22 - CVE-2026-81883 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-81883

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Lua 5.3 bytecode function parser inside libr/bin/format/lua/lua.c. When radare2 parses a Lua function structure, it first reads the function-name string using parseStringR, which advances an internal offset. The parser then reads two integers and three one-byte fields for function metadata without confirming the remaining input buffer contains enough bytes. When a crafted Lua 5.3 bytecode file positions the function-name string so it ends exactly at the input-buffer boundary, the subsequent reads for lineDefined, lastLineDefined, and additional single-byte metadata fields access memory beyond the allocated buffer. The result is either invalid parser output or process termination of the radare2 process.

Root Cause

The root cause is missing bounds validation between two parsing steps. The parseStringR call returns an updated offset, but the code does not verify that size - offset accommodates lh->intSize * 2 + 3 additional bytes before dereferencing data + offset. This is a classic input validation gap in a binary format parser handling attacker-controlled files.

Attack Vector

Exploitation requires local access and user interaction. An analyst must open or inspect a crafted Lua 5.3 bytecode file with radare2 for the vulnerable code path to execute. There is no network attack vector and no privilege escalation. The confirmed impact is limited to availability, primarily through process crash.

// Patch from libr/bin/format/lua/lua.c
// Adds a bounds check before reading function metadata
 	function->parent_func = parent_func;
 	function->offset = offset;
 	offset = parseStringR (lh, data, offset, size, &function->name_ptr, &function->name_size, parseStruct);
-	if (offset == 0) {
-		free (function);
-		return 0;
+	if (!offset || offset > size || size - offset < lh->intSize * 2 + 3) {
+		goto beach;
 	}
 
 	function->lineDefined = parseInt (data + offset);

Source: radare2 commit 26c2eac

The patch replaces a simple offset-equals-zero check with three conditions: offset validity, offset not exceeding buffer size, and sufficient remaining bytes for the upcoming metadata reads.

Detection Methods for CVE-2026-81883

Indicators of Compromise

Unexpected crashes or abnormal termination of radare2, r2, or rabin2 processes during analysis of Lua bytecode files
Presence of Lua 5.3 bytecode files (magic bytes 1B 4C 75 61 53) from untrusted sources in analyst workstations or automated triage pipelines
Core dumps or crash reports referencing the lua.c parser inside radare2

Detection Strategies

Inventory installed radare2 versions across analyst endpoints and CI/CD analysis pipelines, flagging any release earlier than 6.2.0
Monitor for repeated radare2 crashes correlated with Lua file ingestion, which may indicate accidental or intentional triggering
Enable AddressSanitizer or equivalent runtime instrumentation in sandboxed analysis environments to catch the out-of-bounds read at ingestion time

Monitoring Recommendations

Log invocations of radare2 tooling in shared malware analysis environments and alert on unexpected termination signals
Track file provenance for Lua bytecode samples processed by automated reverse engineering workflows
Review advisory GHSA-96m5-hvwp-674c for updates to the affected code path

How to Mitigate CVE-2026-81883

Immediate Actions Required

Upgrade radare2 to version 6.2.0 or later on all analyst workstations and analysis servers
Restrict analysis of untrusted Lua 5.3 bytecode files to isolated sandbox environments until upgrades are complete
Rebuild container images and reproducible analysis environments that pin older radare2 releases

Patch Information

The fix is available in radare2 release 6.2.0 and is delivered by commit 26c2eac360033458e9d266e5e30667d1f8d642e3. Additional context is available in GitHub issue 26228 and the GHSA-96m5-hvwp-674c advisory.

Workarounds

Avoid opening Lua 5.3 bytecode files from untrusted origins with vulnerable radare2 builds
Run radare2 inside a restricted user account or container so crashes do not disrupt other work
Use file-type allowlisting in automated pipelines to exclude Lua bytecode until radare2 is updated

bash

# Verify installed radare2 version and upgrade if below 6.2.0
r2 -v

# Build and install radare2 6.2.0 from source
git clone https://github.com/radareorg/radare2.git
cd radare2
git checkout 6.2.0
sys/install.sh

# Confirm the fixed version is active
r2 -v