CVE-2026-14758: radare2 Integer Overflow in Hexpairs Parser (Local DoS)

Technical summary

CVE-2026-14758 is an integer overflow vulnerability in the cmd_anal_opcode function within libr/core/cmd_anal.inc.c of radare2 versions up to 6.1.6. The flaw resides in the hexpairs parser component. Integer overflows in parsing logic can lead to unexpected memory behavior; in this case, the result is a denial-of-service condition. The vulnerability is triggered through local command execution and does not require elevated privileges. A public exploit exists, increasing the likelihood of opportunistic use.

Business impact

For organizations using radare2 as part of their security toolkit—particularly reverse-engineering teams, malware analysts, or threat researchers—this vulnerability could disrupt analysis workflows. An attacker with local system access could crash radare2 mid-analysis session, forcing analysts to lose unsaved work or restart investigations. In environments where radare2 is embedded in CI/CD pipelines for binary analysis, exploitation could halt automated security scanning. The impact is limited to availability; no data exfiltration or code execution is possible.

Affected systems

radare2 versions up to and including 6.1.6 are affected. Any system running radare2 with these versions is at risk if local users can invoke the tool. This includes developer workstations, security labs, and automated analysis servers running vulnerable versions. Systems running patched versions or radare2 7.0.0 and later (verify against vendor release notes) are not affected.

Exploitability

The CVSS 3.1 score of 3.3 (LOW severity) reflects the local-only attack vector and the requirement for an authenticated user (PR:L). While public exploit code exists, the attack surface is constrained: an attacker must already have shell access or user privileges on the target machine. This makes it unsuitable for remote attacks but a practical concern for multi-user systems, shared lab environments, or systems where untrusted users can submit analysis tasks to radare2.

Remediation

Apply the patch identified by commit 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 to remediate the vulnerability. Verify that your installed version of radare2 includes this commit by checking the version number against the vendor's release notes and changelog. Alternatively, upgrade to the first patched release version available after 6.1.6 (consult radare2's official repository for confirmation).

Patch guidance

Obtain the latest radare2 release from the official GitHub repository (github.com/radareorg/radare2) or your distribution's package manager if backported patches are available. If you maintain a custom build, cherry-pick commit 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 into your release branch and rebuild. Test the patched version in a non-production environment before deployment to ensure no regression in your analysis workflows. For users of radare2 in scripted or automated contexts (e.g., via r2pipe), validate that analysis scripts handle graceful failure if radare2 unexpectedly terminates.

Detection guidance

Monitor system logs for unexpected terminations or crashes of radare2 processes, particularly if they correlate with unusual command patterns or inputs to the analysis subsystem. In sandboxed or containerized analysis environments, watch for repeated radare2 container/process restarts. Network-based detection is not applicable since the attack is local-only. Consider logging command-line arguments passed to radare2 to detect potential fuzzing or malformed hexpairs input being fed to the opcode parser. Endpoint detection and response (EDR) tools can flag abnormal process termination patterns if radare2 is being deliberately crashed as part of a supply-chain or persistence evasion technique.

Why prioritize this

Although the CVSS score is LOW, prioritize this vulnerability if your organization operates multi-user systems or shared analysis infrastructure where untrusted users can execute radare2. The existence of public exploit code and the ease of triggering a crash make it attractive for denial-of-service scenarios in collaborative environments. For single-user workstations or isolated labs, prioritization can be deferred, but patching should still be applied during the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects: (1) local attack vector only, eliminating remote exploitation; (2) low privilege requirement (PR:L), meaning a basic user can trigger it; (3) low complexity (AC:L), indicating no special conditions are needed; (4) availability impact only (A:L), producing a crash but no confidentiality or integrity breach. The presence of a public exploit elevates real-world risk slightly beyond the base score but does not change the fundamental constraint that physical or authenticated local access is mandatory.

Frequently asked questions