CVE-2026-14761mediumCWE-189CWE-190

CVE-2026-14761: medium-severity vulnerability in radareorg radare2

radareorg radare2 str.c r_str_append integer overflow

Published · Updated

Follow this CVE+ Monitor radare2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.8epss 0.2%
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
radareorg · radare2
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — radareorg radare2

In the same product, most dangerous first.

CVE-2020-15121HIGHCommand injection in Radare2EPSS 1.6%CVE-2026-40499HIGHradare2 < 6.1.4 Command Injection via PDB Parser print_gvars()EPSS 1.2%CVE-2026-40517HIGHradare2 < 6.1.4 Command Injection via PDB Parser Symbol NamesEPSS 1.1%CVE-2026-40527HIGHradare2 Command Injection via DWARF Parameter NamesEPSS 0.9%CVE-2025-1744CRITICALOut-of-bounds Write in radare2EPSS 0.5%CVE-2025-1864CRITICALBuffer Overflow and Potential Code Execution in Radare2EPSS 0.5%