CVE-2026-14761: Integer Overflow in radare2 String Functions – Patch & Remediation

Technical summary

CVE-2026-14761 is an integer overflow vulnerability in radare2 (a reverse-engineering framework) located in libr/util/str.c. The vulnerable functions r_str_ndup and r_str_append fail to properly validate input sizes before allocating or manipulating memory, leading to arithmetic overflow conditions. An attacker must have local code execution or shell access to trigger the overflow, and successful exploitation results in application crash (availability impact). The CVSS 3.1 score of 3.3 reflects low severity due to local-only attack vector and absence of confidentiality or integrity compromise.

Business impact

For organizations using radare2 in security research, malware analysis, or reverse-engineering workflows, this vulnerability could disrupt analyst productivity through unplanned tool crashes. However, the risk is contained: an attacker cannot extract sensitive analysis data, modify reports, or escalate privileges through this flaw. Teams relying heavily on radare2 for IR or threat analysis should plan a controlled update to minimize downtime. The low CVSS score and absence of data breach risk mean this is not an enterprise crisis, but should still be addressed in normal patching cycles.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. Any deployment running an affected version is vulnerable if the system permits local user access or if radare2 is exposed to untrusted input through local APIs or scripts. This includes security research labs, penetration testing platforms, and development environments where radare2 is installed. Static analysis tools or CI/CD pipelines that invoke radare2 binaries should also be evaluated.

Exploitability

The vulnerability requires local attack vector—an attacker must already have shell access or the ability to execute code on the host where radare2 runs. Public disclosure of an exploit has occurred, meaning the technical details are known, but the barrier to exploitation remains high due to the local-only constraint. Malicious scripts, untrustworthy plugins, or cooperative users with intent to disrupt could trigger the flaw. Remote exploitation is not possible via this vector alone.

Remediation

Apply the patch identified by commit a20a56917ae85d732e683f8d9078bdcfee92446c or upgrade to a radare2 version released after the patch was integrated. Verify the patch version by consulting the official radare2 project repository. If immediate patching is not feasible, restrict local access controls to radare2 and audit which users and processes have permission to invoke the tool. Disable or isolate radare2 instances that accept untrusted input until patching is complete.

Patch guidance

The patch commit a20a56917ae85d732e683f8d9078bdcfee92446c addresses the integer overflow by implementing proper bounds checking in the r_str_ndup and r_str_append functions. Organizations should verify this commit is present in their target version before deploying. Check the official radare2 GitHub repository and release notes to confirm which stable version includes this fix, and test the patched version in a lab environment before rolling out to production analysis systems. No rollback concerns are anticipated, as the patch only adds safety checks.

Detection guidance

Monitor for radare2 process crashes or unexpected terminations, particularly if accompanied by system logs showing integer overflow or memory allocation errors. If radare2 runs as a service or daemon, configure alerting on restart events. For deployed instances, consider running a vulnerability scanner that detects radare2 version strings in process lists or installed packages. Additionally, review access logs to identify which local users or processes invoke radare2, and cross-reference against your threat model to assess insider or lateral movement risk.

Why prioritize this

Although the CVSS score is low (3.3), this vulnerability merits timely attention because: (1) the exploit is publicly available and could be weaponized by insiders or low-privilege users to disrupt analysis workflows, (2) radare2 is often used in high-sensitivity security research environments where unexpected tool failures create friction, and (3) the patch is straightforward and unlikely to introduce regressions. Prioritize patching for radare2 instances that are internet-facing or accept untrusted input, but treat it as routine maintenance for isolated research labs.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW severity) reflects the attack vector (local only), low complexity, low privileges required to trigger, and impact limited to availability. The vulnerability does not compromise confidentiality or integrity, which significantly caps the severity rating. Organizations with strong local access controls and air-gapped analysis environments face lower actual risk than those with permissive user shells or cloud-hosted radare2 instances. This score accurately represents the technical threat, but business context (tool criticality to your IR function) should inform your actual remediation timeline.

Frequently asked questions