CVE-2026-14758
radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow
CVSS Score
3.3
EPSS Score
0.1%
EPSS Percentile
2th
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
| CWE | CWE-190 CWE-189 |
| Vendor | radareorg |
| Product | radare2 |
| Published | Jul 5, 2026 |
| Last Updated | Jul 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for radareorg radare2
Be the first to know when new low vulnerabilities affecting radareorg radare2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
radareorg / radare2
6.1.0 6.1.1 6.1.2 6.1.3 6.1.4 6.1.5 6.1.6
References
vuldb.com: https://vuldb.com/vuln/376347 vuldb.com: https://vuldb.com/vuln/376347/cti vuldb.com: https://vuldb.com/cve/CVE-2026-14758 vuldb.com: https://vuldb.com/submit/850382 github.com: https://github.com/radareorg/radare2/issues/26042 github.com: https://github.com/radareorg/radare2/commit/84e773986e7e5bb30453a9384f498ec0ccc9d0a9 github.com: https://github.com/radareorg/radare2/
Credits
🔍 Kery Qi (VulDB User)