This vulnerability arises when radare2 parses an untrusted binary property‑list (bplist). The parser under‑allocates its UTF‑8 buffer and never guarantees NUL termination. The JSON encoder then treats the corrupted string as a null‑terminated C string and reads past the buffer boundary. The overflow exposes data that had not been initialized or data that was recently released on the heap, and in some cases can crash the process. The weakness is a classic heap out‑of‑bounds read that can lead to accidental disclosure of sensitive information or a denial of service.

All installations of radare2 older than version 6.2.0 are affected. The issue is specific to the binary‑property‑list Unicode parser that is invoked by the pFB or pFBj commands. Because radare2 is a reverse‑engineering framework deployed on UNIX‑like systems, any environment where the vulnerable binary is parsed—whether locally or via a service that calls radare2 with untrusted input—falls under the impact zone.

The CVSS score of 3.3 places the weakness in the low‑severity range. The EPSS score is not available, so the exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog and no public exploits have been disclosed. Because the attacker must supply crafted bplist data and invoke the specific commands, the attack vector is local or remote depending on how radare2 is exposed. The vulnerability can lead to information leakage and process termination, so mitigation is recommended.