CVE-2026-14757 | A vulnerability was determined in radareorg radare2 up to 6.… | CVSS 5.3 MEDIUM

Description

A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.

Metadata

CVE ID: CVE-2026-14757
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-04 16:19 UTC
Published: 2026-07-05 14:45 UTC
Last updated: 2026-07-05 14:45 UTC
Primary CWE: CWE-190
Integer Overflow
Vendor / Product: radareorg / radare2
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Affected products (1)

Vendor	Product	Platform	Versions
radareorg	radare2	—	6.1.0, 6.1.1, 6.1.2, 6.1.3 …

Weakness (CWE)

CWE	Source	Description
CWE-189	cna	Numeric Error
CWE-190	cna	Integer Overflow

CVSS scores (4)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
5.3	MEDIUM	3.0	cna	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4.8	MEDIUM	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4.3	N/D	2.0	cna	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

References (6)

VDB-376346 | radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow https://vuldb.com/vuln/376346
VDB-376346 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/376346/cti
CVE-2026-14757 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-14757
Submit #850381 | radareorg radare2 6.1.6 Integer Overflow https://vuldb.com/submit/850381
https://github.com/radareorg/radare2/issues/26041
https://github.com/radareorg/radare2/