By vendor
Radare vulnerabilities
Known CVEs affecting Radare products, prioritized by severity, with SEC.co remediation and detection guidance.
9 published vulnerabilities
- CVE-2026-14757MEDIUM 5.3
An integer overflow flaw exists in radare2, a popular open-source reverse engineering framework, affecting versions up to 6.1.6. The vulnerability resides in the core analysis function and can be exploited by an authenticated local user to trigger memory corruption. While the technical mechanics involve integer overflow, the practical impact is limited to local attackers with existing system access, reducing the immediate risk in typical enterprise environments. Public disclosure has occurred, meaning the general security community now has awareness of the issue.
- CVE-2026-14758LOW 3.3
A bug in radare2 (an open-source reverse-engineering framework) allows a local user with basic privileges to trigger an integer overflow when the hexpairs parser processes specially crafted input in the opcode analysis command. This causes the application to crash. An attacker would need direct access to a system running radare2 and the ability to execute commands locally.
- CVE-2026-14759LOW 3.3
A heap-based buffer overflow vulnerability exists in radare2, a popular reverse-engineering framework, affecting versions up to 6.1.6. The flaw is in the Java class file parser's line number table handler and can be triggered through a specially crafted Java binary. An attacker with local system access can exploit this to crash the application or potentially execute code. Public exploit code is available, elevating operational risk for users who process untrusted Java artifacts.
- CVE-2026-14760LOW 3.3
A use-after-free vulnerability has been discovered in radare2, a popular reverse-engineering framework. The flaw exists in the regprofile handler component and can be triggered by local attackers with low privileges, leading to an application crash or potential memory corruption. While a patch has been released, the vulnerability is not currently listed as exploited in the wild by known ransomware groups or government-backed actors.
- CVE-2026-14761LOW 3.3
A flaw in radare2's string handling functions (r_str_ndup and r_str_append) allows an attacker with local access to cause the application to crash by triggering an integer overflow. The vulnerability affects radare2 up to version 6.1.6. While an exploit has been publicly disclosed, the impact is limited to denial of service—no data theft or privilege escalation is possible from this flaw alone.
- CVE-2026-14786LOW 3.3
A flaw in radare2, a popular reverse engineering framework, allows an authenticated local attacker to trigger an integer overflow through the string handling function. While the vulnerability requires local access and legitimate user privileges, the public release of exploit code means the risk of opportunistic abuse increases. The impact is denial of service—the affected process can crash—but not data theft or privilege escalation.
- CVE-2026-14787LOW 3.3
Radare2, a popular open-source reverse-engineering framework, contains an integer overflow vulnerability in its print command handler that can be triggered by a local user. The flaw affects versions up to 6.1.6 and can cause the application to crash or become unstable. While a public exploit exists, the attack requires local system access and does not enable privilege escalation or data theft. The vendor has released a patch that should be applied to restore stability.
- CVE-2026-14788LOW 3.3
A use-after-free vulnerability exists in Radare2, a widely-used reverse engineering and binary analysis framework. The flaw is located in the binary loading function and can be triggered by a local attacker with basic user privileges. While the vulnerability has been publicly disclosed, its low severity rating reflects limited direct impact—the primary consequence is denial of service through application crash. Organizations using Radare2 in production or security workflows should apply the available patch, particularly if the tool processes untrusted binaries.
- CVE-2026-14789LOW 3.3
A stack-based buffer overflow vulnerability exists in radare2's Memory64ListStream Parser component, which processes memory dump files. An attacker with local access can manipulate a specially crafted input file to trigger a buffer overflow, potentially causing the application to crash. This is a localized denial-of-service issue affecting radare2 versions up to 6.1.6.