CVE-2026-14760

radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free

CVSS 4.8 MEDIUMEPSS 0.1%CWE-119 CWE-416

Vexday Risk Score

33Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 4.8EPSS 0.1%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Ciclo de vida

05 jul 2026Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

radareorg · radare2

PoCs públicas encontradas — 1

cve_referencegithub.com/radareorg/radare2/issues/26044no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

https://github.com/radareorg/radare2/https://github.com/radareorg/radare2/commit/8b25c773785d85cb0103410a0905089d286921c2 https://github.com/radareorg/radare2/issues/26044 https://vuldb.com/cve/CVE-2026-14760 https://vuldb.com/submit/850384 https://vuldb.com/vuln/376349 https://vuldb.com/vuln/376349/cti