CVE-2026-14759: Heap Buffer Overflow in radare2 Java Parser—Patching Guidance

Technical summary

CVE-2026-14759 is a heap buffer overflow in the r_bin_java_inner_classes_attr_calc_size function within shlr/java/class.c of radare2's RBinJava component. The vulnerability resides in the Java class file parser's handling of line number table attributes. It is triggered during the parsing phase when radare2 processes a maliciously crafted Java class file with oversized or malformed line number metadata. The resulting buffer overflow can corrupt adjacent heap memory. The CVSS v3.1 score of 3.3 (LOW) reflects the local-only attack vector and limited impact scope, though availability can be degraded.

Business impact

For security teams and developers using radare2 for malware analysis, reverse engineering, or threat intelligence on Java-based threats, this vulnerability introduces a denial-of-service risk when processing untrusted samples. If radare2 crashes during batch analysis of a suspected malware collection, it can disrupt analysis pipelines and delay incident response. The low CVSS does not reflect the workflow impact; organizations running automated Java decompilation or bytecode analysis at scale should treat this as a service continuity concern rather than a direct data-breach risk.

Affected systems

radare2 versions up to and including 6.1.6 are confirmed vulnerable. Any system where radare2 is installed and used to analyze Java binaries is at risk, particularly: malware analysis workstations, CI/CD pipelines performing automated binary inspection, reverse-engineering labs, and threat intelligence platforms. Users of radare2 on Linux, macOS, and Windows platforms are affected equally. The local-only requirement means the attacker must already have user-level access to the system or control file input to the radare2 process.

Exploitability

Exploitability is moderate to high in operational environments. The local-only attack vector means this is not an external network threat; however, public exploit code is available, lowering the barrier for opportunistic attackers. The attack requires no user interaction—simply opening a crafted Java file in radare2 triggers the flaw. In sandboxed malware analysis environments or open-analysis platforms where users upload samples for processing, this becomes a containment concern: a malicious sample could crash the analysis engine and potentially escape from a weakly isolated container. The low complexity (AC:L) means no special conditions are required beyond file format manipulation.

Remediation

Update radare2 to a version newer than 6.1.6 that includes the patch commit cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. Verify the patch is applied by checking the commit history in your radare2 installation. Until patching is feasible, restrict radare2 to analyzing Java binaries from trusted sources only, or use an isolated VM/container for processing unknown Java samples. Consider temporarily disabling Java binary analysis in automated workflows if they cannot be updated promptly.

Patch guidance

The maintainers have released a fix identified by commit cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. Users should pull the latest version from the radare2 repository or wait for the next official release that incorporates this commit. Verify the fix by confirming the commit is present in your build. If you maintain a local fork or distribution, cherry-pick this commit into your release branch. Test the patched version against your own Java analysis workflows before deploying to production analysis systems.

Detection guidance

On systems running radare2, monitor for unexpected crashes or segmentation faults when processing Java class files, particularly those with unusual line number table metadata. Enable logging in radare2 if available (r2's debug mode with -d flag) and capture crash dumps. On endpoint detection and response (EDR) systems, flag abnormal termination of radare2 processes with access to untrusted files, especially in batch or automated contexts. Network-based detection is not applicable given the local-only nature; focus on behavioral signals such as rapid repeated radare2 restarts or memory corruption signatures in process memory dumps.

Why prioritize this

Despite a LOW CVSS score, this vulnerability warrants prompt but not emergency prioritization. The public availability of working exploit code and the local+low-complexity attack surface create a window where an attacker inside your network or with sample-upload capabilities could disrupt your analysis infrastructure. Prioritize patching if: (1) you run automated Java malware analysis, (2) you allow untrusted users to submit samples, or (3) radare2 is critical to your threat intelligence pipeline. For organizations that rarely use radare2 or analyze Java only from verified sources, this can be handled in a regular maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) correctly reflects the constraints: local-only access requirement (AV:L), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and limited scope (S:U). Impact is availability only—no confidentiality or integrity breach. However, in environments where radare2 is a critical path tool, operational impact may be higher than CVSS suggests. The availability of public exploits and the ease of triggering the crash elevate practical risk even though the severity floor remains LOW. Supplement CVSS with your own risk model that accounts for tool criticality and sample exposure.

Frequently asked questions