The vulnerability in radare2 occurs because the Lua 5.3 bytecode function parser reads two integers and three one-byte fields immediately after the function-name string without checking if the buffer has sufficient length. When processing a crafted Lua 5.3 bytecode file where the function-name string ends exactly at the input buffer boundary, the parser reads beyond the allocated buffer, causing an out-of-bounds read (CWE-125). This can result in invalid parser behavior or cause the process to terminate unexpectedly. No evidence of attacker-observable memory disclosure has been demonstrated. The vulnerability affects radare2 versions prior to 6.2.0 and is resolved by upgrading to version 6.2.0.

The out-of-bounds read can cause the radare2 process to terminate unexpectedly or produce invalid parsing results. There is no demonstrated impact on confidentiality or integrity, and no known memory disclosure or code execution has been observed. The overall impact is limited to availability disruption of the radare2 tool during processing of crafted Lua 5.3 bytecode files.

This vulnerability is fixed in radare2 version 6.2.0. Users should upgrade to version 6.2.0 or later to remediate this issue. No additional mitigation is required beyond applying the official fix.