CVE-2026-14786: Integer Overflow in Radare2 String Handling (Local DoS)

Technical summary

CVE-2026-14786 stems from an integer overflow vulnerability in the r_str_word_get0set function within libr/util/str.c of radare2 versions up to 6.1.6. The flaw arises from insufficient bounds checking during string word extraction, permitting a local, authenticated user to supply a specially crafted input that causes an integer wraparound. This leads to memory access violations and process termination. The vulnerability is classified under CWE-189 (Numeric Errors) and CWE-190 (Integer Overflow or Wraparound), both of which are known precursors to memory corruption issues.

Business impact

For organizations using radare2 as part of their reverse engineering, malware analysis, or security research workflows, this vulnerability introduces a localized denial-of-service risk. An insider or compromised local account could crash radare2 instances, interrupting active analysis work and potentially disrupting incident response or threat analysis timelines. The low CVSS score reflects the limited scope—only local users can exploit it—but teams relying on radare2 for critical security operations should assess continuity implications.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. Any installation of radare2 on systems where untrusted or semi-trusted local users have account access presents a potential attack surface. This includes shared analysis environments, container orchestration platforms where radare2 is deployed as a service, and development workstations in multi-user settings.

Exploitability

Exploitation requires local system access and valid user credentials; remote exploitation is not possible. However, the public release of exploit code lowers the barrier for malicious local actors and simplifies experimentation for internal threat actors or compromised accounts. An attacker with shell access on a system running vulnerable radare2 can trigger the integer overflow with minimal effort, making the practical exploitability moderate within affected environments.

Remediation

Apply the patch identified by commit hash 11ac224c0eb8d57830fccc99e1c1cd8e5d958813 to remediate the vulnerability. Verify the exact version or patch version number against the official radare2 repository and vendor advisories. Organizations should prioritize patching radare2 instances accessible to multiple local users or in shared research environments where denial of service carries operational risk.

Patch guidance

Administrators should verify the current version of radare2 in use (check via 'radare2 -v' or similar version query) and cross-reference against the patched commit hash provided. Update to a version that incorporates commit 11ac224c0eb8d57830fccc99e1c1cd8e5d958813 or later. Check the official radare2 repository and release notes for the specific version number containing this fix. If using radare2 via a package manager (apt, brew, yum, etc.), ensure the available version is updated and then run the package update command. For containerized deployments, rebuild images with patched radare2 versions and re-deploy.

Detection guidance

Monitor for process crashes or unexpected terminations of radare2 instances, particularly when triggered by specific input patterns. Log and alert on failed string parsing or integer overflow exceptions in radare2 error streams. In environments where radare2 is deployed as a service or within containers, implement resource monitoring and crash detection to flag suspicious terminations. Since exploitation is local, correlate radare2 crashes with suspicious local user activity, particularly if timing aligns with unexpected command invocations or unusual file access patterns.

Why prioritize this

Although the CVSS score is low (3.3) and impact is limited to availability, the public availability of exploit code and the multi-user nature of many analysis environments warrant timely patching. Organizations with shared radare2 deployments or where local user isolation is weak should prioritize this over infrastructure-wide high-severity vulnerabilities, but single-user or isolated radare2 instances can follow standard patching cycles. The vulnerability does not compromise data confidentiality or enable privilege escalation, reducing urgency for environments with strong local access controls.

Risk score, explained

The CVSS v3.1 score of 3.3 (LOW) reflects a local-only attack vector (AV:L) with low complexity (AC:L) that requires legitimate user privileges (PR:L) and produces no user interaction requirement (UI:N). The impact is scoped to availability (A:L) with no confidentiality or integrity compromise (C:N, I:N). While the attack is straightforward to execute once access is obtained, the requirement for pre-existing local credentials and the absence of cascading impacts keep the score in the low range. Public exploit availability does not alter the CVSS score but does increase practical risk in environments with untrusted or semi-trusted local users.

Frequently asked questions