CVE-2026-81883Low· 3.3▾ TwilightPoC availableradare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields imm…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
Last analysed / modified upstream
0.2%
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81879Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81884Low· 2.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81881Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81882Low· 3.3radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81878Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset
CVE-2026-81880Medium· 5.5radare2 is a UNIX-like reverse engineering framework and command-line toolset