CVE-2026-14787: Radare2 Integer Overflow in Print Command Handler

Technical summary

CVE-2026-14787 is an integer overflow flaw in the cmd_print function within libr/core/cmd_print.inc, a core component of radare2's print command handler. Integer overflows occur when arithmetic operations exceed the maximum value a variable can hold, causing the value to wrap around unexpectedly. In this case, the overflow is triggered during print command processing and results in a denial of service condition. The vulnerability is classified under CWE-189 (Numeric Errors) and CWE-190 (Integer Overflow or Wraparound). Exploitation requires local code execution context on the target system.

Business impact

Organizations using radare2 for security research, malware analysis, or software development face a localized availability risk. A malicious local user or an attacker with shell access could trigger the crash repeatedly, disrupting analysis workflows and potentially corrupting ongoing reverse-engineering sessions. The impact is limited to availability; confidentiality and integrity of analyzed binaries are not compromised by this flaw. For teams heavily dependent on radare2 in their security operations, unpatched instances may experience intermittent service degradation.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. All deployments of these versions are potentially vulnerable if they operate in environments where untrusted local users have access to the radare2 CLI or if the tool processes untrusted input via the pb (print) command. This includes development machines, isolated analysis workstations, and security research labs.

Exploitability

The vulnerability requires local access and direct interaction with the radare2 command-line interface. An authenticated local user can trigger the integer overflow by supplying specially crafted arguments to the print command. Public exploit code is available, lowering the technical barrier for exploitation. However, the attack does not grant elevated privileges, leak sensitive data, or enable remote execution. The CVSS 3.1 score of 3.3 (LOW) reflects the local-only attack vector and the limited scope of impact.

Remediation

Apply the vendor patch identified by commit hash 2b6265476c75567006b0fcbb749f4ae7b189c5df. Users should update to the first version released after 6.1.6 that incorporates this commit. Until patched, restrict local shell access to untrusted users on systems running radare2, and consider running analysis in isolated environments or containers where user interaction can be controlled and monitored.

Patch guidance

Verify the radare2 release notes and GitHub repository to confirm that your target version includes commit 2b6265476c75567006b0fcbb749f4ae7b189c5df. Most organizations should prioritize patching development and analysis workstations where radare2 is actively used. Since the CVSS score is LOW, patching can be scheduled in a regular maintenance window unless your environment has specific availability requirements. Test patches in a non-production lab first to ensure compatibility with custom scripts or integrations.

Detection guidance

Monitor radare2 process logs and system logs for repeated crashes or abnormal terminations of the radare2 binary. Look for unusual arguments passed to the pb command that contain extremely large numeric values or specially formatted strings. In environments where radare2 is containerized or sandboxed, review container or VM exit codes and segmentation fault logs. Intrusion detection systems may flag repeated attempts to invoke the print command with malformed input if deployed with appropriate rules.

Why prioritize this

Although the CVSS score is LOW, this vulnerability should not be deferred indefinitely because public exploit code exists. Threat actors could use it to disrupt security operations or testing environments, and the availability impact may cascade if radare2 crashes corrupt analysis data or lock files. Prioritization should be based on how critical radare2 is to your organization's core security operations. Development teams should apply the patch promptly; general enterprise environments can schedule it within their next quarterly patch cycle.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects the following factors: a local attack vector (AV:L) prevents remote exploitation; low complexity (AC:L) means no special conditions are needed; low privileges (PR:L) indicate a standard user can trigger the flaw; no user interaction (UI:N) is required; and the impact is limited to availability (A:L) with no confidentiality or integrity loss (C:N, I:N). The score would be higher if the flaw enabled privilege escalation or data exfiltration, but the bounded scope makes it a low-severity issue overall.

Frequently asked questions