CVE-2026-14760
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
CVSS Score
3.3
EPSS Score
0.1%
EPSS Percentile
2th
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
| CWE | CWE-416 CWE-119 |
| Vendor | radareorg |
| Product | radare2 |
| Published | Jul 5, 2026 |
| Last Updated | Jul 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for radareorg radare2
Be the first to know when new low vulnerabilities affecting radareorg radare2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
radareorg / radare2
6.1.0 6.1.1 6.1.2 6.1.3 6.1.4 6.1.5 6.1.6
References
vuldb.com: https://vuldb.com/vuln/376349 vuldb.com: https://vuldb.com/vuln/376349/cti vuldb.com: https://vuldb.com/cve/CVE-2026-14760 vuldb.com: https://vuldb.com/submit/850384 github.com: https://github.com/radareorg/radare2/issues/26044 github.com: https://github.com/radareorg/radare2/commit/8b25c773785d85cb0103410a0905089d286921c2 github.com: https://github.com/radareorg/radare2/
Credits
🔍 Kery Qi (VulDB User)