CVE-2026-81882

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0

Description The binary property-list Unicode parser underallocates an uninitialized UTF-8 destination and fails to guarantee NUL termination. This occurs when executing the pFB or pFBj commands on untrusted binary property-list data. Because the JSON encoder treats the converted data as a NUL-terminated C string, it may read beyond the allocated memory, potentially leading to the disclosure of uninitialized or adjacent heap contents in the JSON output or causing the process to terminate.

Recommendations Update to version 6.2.0.