CVE-2026-14789
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was found in radare2 up to version 6.1.6 in the Memory64ListStream parser within mdmp.c. A local attacker can trigger a stack-based buffer overflow by manipulating input data. The exploit is publicly available.
Risk Assessment
The organization is at risk of local code execution or application crash, potentially leading to privilege escalation or data loss.
Recommendation
Apply the patch (commit 175d4addb68981331c85b10681c2161c38fb5762) or upgrade radare2 to a version newer than 6.1.6 immediately.
Other vulnerabilities in radare2
See all- CVE-2026-8696High
Version 6.1.5 of radare2 contains a use-after-free vulnerability in the gdbr_pids_list() function, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses.
- CVE-2026-8695High
radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.
- CVE-2026-40499High
radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.
- CVE-2017-15932High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in elf.c, which can be triggered by crafted ELF files when parsing the ELF version on 32-bit systems.
- CVE-2017-15931High
In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in elf.c, which can be exploited via crafted ELF files on 32-bit systems.
- CVE-2017-15385High
The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.
- CVE-2017-15368High
The wasm_dis function in radare2 version 2.0.0 allows remote attackers to cause denial of service through stack-based buffer over-read, leading to application crash. The attack can be executed using a crafted WASM file that triggers an incorrect r_hex_bin2str call.
- CVE-2017-10929High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.
- CVE-2017-9949High
The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service via a crafted binary file, potentially leading to application crashes due to a buffer underflow.
- CVE-2017-6448High
The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
Original NVD description (English source)
A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS