CVE-2026-81883

Description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: LOW
CVSS score: 3.3 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Effective score: 3.3 / 10 LOW source: CNA overview
CWE(s): CWE-125
Reserved: 2026-08-27
Published: 2026-09-22 15:14 UTC
Last updated: 2026-09-22 16:11 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81883.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 16:18:03 UTC
NVD last modified: 2026-09-22 17:17:25 UTC
NVD CVSS v3.1: 3.3 / 10 LOW source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Exploitability subscore: 1.8 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84472
Assigner: GitHub_M
Published: Sep 22, 2026, 3:14:47 PM
Updated: Sep 22, 2026, 4:11:40 PM
EUVD base score (CVSS 3.1): 3.3 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EUVD-reported EPSS: 0.0000
Vendors: radareorg
Products: radare2 (< 6.2.0)

ENISA description: radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
radareorg	radare2	`< 6.2.0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c x_refsource_CONFIRM
https://github.com/radareorg/radare2/issues/26228 x_refsource_MISC
https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3 x_refsource_MISC
https://github.com/radareorg/radare2/releases/tag/6.2.0 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3 security-advisories@github.com
https://github.com/radareorg/radare2/issues/26228 security-advisories@github.com
https://github.com/radareorg/radare2/issues/26228 134c704f-9b21-4f2e-91b3-4a467353bcc0
https://github.com/radareorg/radare2/releases/tag/6.2.0 security-advisories@github.com
https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c security-advisories@github.com

Remediations (10)

CVE-2026-81883 - Red Hat Customer Portal

web:access.redhat.com

Description A flaw was found in radare2, a reverse engineering framework. The Lua 5.3 bytecode function parser did not properly validate the length of function-metadata fields after a function-name string. By opening or inspecting a specially crafted Lua 5.3 bytecode file, a local user could trigger an out-of-bounds read. This could lead to invalid parser results or cause the application to ...

2026-09-23 15:43 UTC
CVE-2026-81883: Radareorg Radare2 Vulnerability | CVETodo

web:cvetodo.com

CVE-2026-81883 is a CVSS 3.3 low-severity vulnerability in Radareorg Radare2. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-23 15:43 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-23 15:43 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-23 15:43 UTC
August 2026 CVE Advisory Notification - Security

web:support.servicenow.com

Due to additional analysis provided by the security researcher who discovered CVE - 2026 -6876, we have upgraded the severity rating of CVE - 2026 -6876 from High to Critical. This change affects only the severity

2026-09-23 15:43 UTC
August's Patch Tuesday is a monster: 751 fixes, with an exploited ...

web:www.computerworld.com

August's Patch Tuesday is a big one: 751 fixes, an exploited WinSock flaw and plenty of critical Windows, Office and Exchange issues.

2026-09-23 15:43 UTC
CVE-2026-81883: radareorg radare2: radare2 is a UNIX-like ... - Rapid7

web:www.rapid7.com

CVE-2026-81883 : radareorg radare2: radare2 is a UNIX-like reverse engineering framework and command-line toolset. View severity, references, and remediation details from Rapid7.

2026-09-23 15:43 UTC
CVE-2026-81883 | Tenable®

web:www.tenable.com

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 ...

2026-09-23 15:43 UTC
Vulnerabilities Resolved in Veeam Backup & Replication 13.0.1.2067

web:www.veeam.com

When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.

2026-09-23 15:43 UTC
Patch Tuesday September 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-09-23 15:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-81883.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81883",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T16:11:00.525508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T16:11:40.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/radareorg/radare2/issues/26228"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "radare2",
          "vendor": "radareorg",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is fixed in version 6.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T15:14:47.022Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c"
        },
        {
          "name": "https://github.com/radareorg/radare2/issues/26228",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/radareorg/radare2/issues/26228"
        },
        {
          "name": "https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3"
        },
        {
          "name": "https://github.com/radareorg/radare2/releases/tag/6.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/radareorg/radare2/releases/tag/6.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-96m5-hvwp-674c",
        "discovery": "UNKNOWN"
      },
      "title": "radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-81883",
    "datePublished": "2026-09-22T15:14:47.022Z",
    "dateReserved": "2026-08-27T17:48:42.122Z",
    "dateUpdated": "2026-09-22T16:11:40.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}