CVE-2026-14760: Use-After-Free in Radare2 regprofile Handler

Technical summary

CVE-2026-14760 is a use-after-free memory safety issue in the r_core_seek_arch_bits function within libr/core/disasm.c of radare2 up to version 6.1.6. The vulnerability falls under CWE-119 (Buffer Overflow) and CWE-416 (Use After Free), indicating improper memory management when the regprofile handler processes certain inputs. Exploitation requires local system access and standard user privileges; no user interaction is needed. The CVSS 3.1 score of 3.3 reflects a low-severity impact limited primarily to availability (denial of service via crash).

Business impact

The business impact is minimal for most organizations, given the low CVSS score and local-access-only requirement. However, security researchers, reverse-engineering teams, and threat-intelligence analysts who actively use radare2 on shared or multi-tenant systems face a modest risk. A successful exploit could crash the application, interrupting analysis workflows and potentially losing unsaved work. In scenarios where radare2 processes untrusted binaries in automated pipelines or in environments with multiple local users, an attacker could exploit this to disrupt operations or trigger unexpected behavior.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. The vulnerability is specific to the regprofile handler component, so it would be triggered only when radare2 operations involve architecture or profile configuration changes. Organizations running radare2 in isolated environments (single-user, airgapped systems) face lower risk than those with multi-user access or automated binary analysis pipelines.

Exploitability

Public exploit code has been disclosed, reducing the barrier to exploitation. However, the attack vector is strictly local—an attacker must already have access to the system and execute code as a standard user (non-root). This significantly constrains real-world risk for most deployments. The accessibility of proof-of-concept code means that once a threat actor gains initial local access, they could leverage this flaw to cause instability or, in specific scenarios, potentially escalate impact through information disclosure or undefined behavior.

Remediation

Upgrade radare2 to a patched version released after the vulnerability disclosure. The vendor has released a fix identified by commit hash 8b25c773785d85cb0103410a0905089d286921c2; verify against the official radare2 GitHub repository for the corresponding patched release version. For organizations unable to patch immediately, limit local system access and isolate radare2 instances processing untrusted binaries on dedicated systems with restricted user accounts.

Patch guidance

Check the radare2 project's official repository and release notes to identify the first patched version that includes commit 8b25c773785d85cb0103410a0905089d286921c2. Apply the update to all systems running radare2 6.1.6 or earlier. If you operate radare2 in containerized environments, rebuild container images with the patched version. For integrated or enterprise deployments, test the patch in a non-production environment first, as radare2 updates may affect plugin compatibility or analysis scripts.

Detection guidance

Monitor for unexpected crashes or segmentation faults in radare2 processes, particularly when they are processing unusual or malformed binaries. If possible, enable core dumps and examine them for patterns involving memory corruption in the disasm.c component. In multi-user systems, audit local access logs for any unauthorized or suspicious use of radare2, particularly if combined with attempts to load specially crafted binaries. No network-level detection is possible, as this is a local-only vulnerability.

Why prioritize this

Despite the low CVSS score, this vulnerability warrants timely attention because (1) exploit code is public, (2) radare2 is widely used by security teams and malware analysts, and (3) attackers with local access could easily weaponize it to disrupt or destabilize security operations. However, it should not take priority over higher-severity network-exploitable vulnerabilities. Organizations should patch on a standard maintenance cycle within 30–60 days, prioritizing systems that process untrusted binaries or operate in multi-user environments.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), and limited impact to availability only (A:L). No confidentiality or integrity impact is recorded in the official vector. While the presence of public exploit code increases practical exploitability, the overall risk remains constrained by the local-access requirement. Organizations with strong access controls and isolated radare2 deployments should assess their actual risk as minimal.

Frequently asked questions