Medium severity · published Jul 5, 2026
CVE-2026-14758
radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
radare2 · radareorg
6.1.0; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 6.1.5; +1 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14758
Product
https://github.com/radareorg/radare2/
Patch
https://github.com/radareorg/radare2/commit/84e773986e7e5bb30453a9384f498ec0ccc9d0a9
Exploit
https://github.com/radareorg/radare2/issues/26042
Third Party Advisory
https://vuldb.com/cve/CVE-2026-14758
Third Party Advisory
https://vuldb.com/submit/850382
Third Party Advisory
https://vuldb.com/vuln/376347
More from radare2
7.8
CVE-2026-14789
radareorg radare2 Memory64ListStream mdmp.c stack-based overflow
7.8
CVE-2026-14788
radareorg radare2 cfile.c r_core_bin_load use after free
7.8
CVE-2026-14787
radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow
7.8
CVE-2026-14760
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
7.8
CVE-2026-14759
radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow