CVE-2026-14788
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A use-after-free vulnerability has been detected in radare2 up to version 6.1.6 in the function r_core_bin_load within libr/core/cfile.c. The attack requires local access and the exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of local code execution or program crash in radare2, potentially compromising the integrity of analyzed binary data.
Recommendation
Apply the patch identified as 635ab1eeb30340c26076722a90cb91fb2272130b or upgrade radare2 to a version newer than 6.1.6 immediately.
Original NVD description (English source)
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.