CVE-2026-14789
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was found in radare2 up to version 6.1.6 in the Memory64ListStream parser within mdmp.c. A local attacker can trigger a stack-based buffer overflow by manipulating input data. The exploit is publicly available.
Risk Assessment
The organization is at risk of local code execution or application crash, potentially leading to privilege escalation or data loss.
Recommendation
Apply the patch (commit 175d4addb68981331c85b10681c2161c38fb5762) or upgrade radare2 to a version newer than 6.1.6 immediately.
Original NVD description (English source)
A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.