CVE-2026-14788

LOW 3.3

radareorg radare2 cfile.c r_core_bin_load use after free

CVSS Score

3.3

EPSS Score

0.1%

EPSS Percentile

2th

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.

CWE	CWE-416 CWE-119
Vendor	radareorg
Product	radare2
Published	Jul 6, 2026
Last Updated	Jul 6, 2026

Stay Ahead of the Next One

Get instant alerts for radareorg radare2

Be the first to know when new low vulnerabilities affecting radareorg radare2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

radareorg / radare2

6.1.0 6.1.1 6.1.2 6.1.3 6.1.4 6.1.5 6.1.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/376377 vuldb.com: https://vuldb.com/vuln/376377/cti vuldb.com: https://vuldb.com/cve/CVE-2026-14788 vuldb.com: https://vuldb.com/submit/850388 github.com: https://github.com/radareorg/radare2/issues/26049 github.com: https://github.com/oldzhu/radare2/commit/635ab1eeb30340c26076722a90cb91fb2272130b github.com: https://github.com/radareorg/radare2/

Credits

🔍 Kery Qi (VulDB User)