Medium severity · published Jul 5, 2026
CVE-2026-14761
radareorg radare2 str.c r_str_append integer overflow
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
radare2 · radareorg
6.1.0; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 6.1.5; +1 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14761
Product
https://github.com/radareorg/radare2/
Patch
https://github.com/radareorg/radare2/commit/a20a56917ae85d732e683f8d9078bdcfee92446c
Exploit
https://github.com/radareorg/radare2/issues/26045
Third Party Advisory
https://vuldb.com/cve/CVE-2026-14761
Third Party Advisory
https://vuldb.com/submit/850385
Third Party Advisory
https://vuldb.com/vuln/376350
More from radare2
9.8
CVE-2025-1864
Buffer Overflow and Potential Code Execution in Radare2
9.8
CVE-2025-1744
Out-of-bounds Write in radare2
7.8
CVE-2026-14789
radareorg radare2 Memory64ListStream mdmp.c stack-based overflow
7.8
CVE-2026-14788
radareorg radare2 cfile.c r_core_bin_load use after free
7.8
CVE-2026-14787
radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow