CVE-2026-81883

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0

Description The Lua 5.3 bytecode function parser fails to verify the remaining buffer length when reading fixed function-metadata fields immediately following a function-name string. This issue occurs when opening or inspecting a specially crafted Lua 5.3 bytecode file where the function-name string ends exactly at the input-buffer boundary, causing the parser to read two integers and three one-byte fields beyond the allocated buffer. This can lead to process termination or invalid parser results.

Recommendations Update to version 6.2.0.