radare2 is a Unix‑like reverse engineering framework that includes a Lua 5.3 bytecode parser. Prior to version 6.2.0 the parser reads fixed function‑metadata fields immediately after a function‑name string without validating that the remaining buffer length is sufficient. When a crafted Lua bytecode file has a function‑name string ending at the input‑buffer boundary, the parser reads two integers and three one‑byte fields beyond the allocated buffer. This out‑of‑bounds read can produce invalid parsing results or cause the process to terminate; no memory disclosure has been demonstrated.

The issue affects radare2 versions older than 6.2.0. Any installation that processes Lua 5.3 bytecode files, such as standard use of radare2 or custom scripts that invoke the bytecode parser, is susceptible. The vulnerability is vendor‑specific to radareorg’s radare2 product.

The CVSS score of 3.3 indicates a low‑to‑moderate severity. Exploitation requires an attacker to supply a crafted Lua 5.3 bytecode file and trigger the parser, typically by opening or inspecting the file. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited threat of active exploitation. Nonetheless the boost crash risk makes it a candidate for a denial‑of‑service attack if an attacker can influence file selection or input. Monitoring logs for unexpected terminations and applying the vendor fix are prudent.