radare2 CVE-2026-81883

Exploitation requires a victim running radare2 prior to 6.2.0 to open or inspect an attacker-supplied, crafted Lua 5.3 bytecode file in which the function-name string ends exactly at the input-buffer boundary (so the parser's subsequent reads of two integers and three one-byte metadata fields fall past the allocation). Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - the analyst must actively load the malicious file; there is no network-triggerable path, no privilege escalation, and no code execution or data disclosure, so the realistic outcome is limited to crashing the analyst's own radare2 process.

This is a genuinely low-priority issue whose signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.3) describes a local, user-interaction-gated out-of-bounds READ (CWE-125) with impact limited to availability - the description explicitly states 'no attacker-observable memory disclosure has been demonstrated,' which is why C:N and I:N are correct. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis; the worst realistic outcome is a crash of the radare2 process while an analyst inspects a crafted file. The only mild tension in the input is between the metadata Tags ('Buffer Overflow', 'Information Disclosure') and the actual technical facts: the vulnerability is an over-READ of two integers and three one-byte fields past the input buffer that yields invalid results or termination - NOT a memory-disclosure primitive and not a write overflow. Net: a real but very low-severity robustness bug in a file parser, not an exploitation priority.

An attacker crafts a malicious Lua 5.3 bytecode file whose function-name string terminates exactly at the input-buffer boundary and distributes it (e.g., as a sample submitted for analysis). When a reverse engineer opens or inspects the file in radare2 prior to 6.2.0, the Lua parser reads fixed function-metadata fields past the allocated buffer, producing corrupted parse output or terminating the process. No public exploit code is identified, and impact is confined to denial of service against the analyst's local tool; no code execution or memory disclosure has been demonstrated.