Back to overview

CVE-2026-14758

LOW Exploitation: PoC
3.3
CVSS 3.1
Description
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.

Metadata

CVE ID
CVE-2026-14758
State
PUBLISHED
Assigner
VulDB
Reserved
2026-07-04 16:19 UTC
Published
2026-07-05 15:00 UTC
Last updated
2026-07-06 13:08 UTC
Primary CWE
CWE-190
Integer Overflow
Vendor / Product
radareorg / radare2
Sources
cve.org  ·  NVD

Severity & Metrics

3.3 LOW CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
radareorg radare2 — 6.1.0, 6.1.1, 6.1.2, 6.1.3 …
Weakness (CWE)
CWESourceDescription
CWE-189 cna Numeric Error
CWE-190 cna Integer Overflow
CVSS scores (4)
ScoreSeverityVersionSourceVector
4.8 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
3.3 LOW 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
3.3 LOW 3.0 cna CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
1.7 N/D 2.0 cna AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
References (7)
Back to overview