CVE-2026-14788: Use-After-Free in Radare2 Binary Loading—Patch Guidance

Technical summary

CVE-2026-14788 is a use-after-free vulnerability in radare2 versions up to 6.1.6, specifically within the r_core_bin_load function in libr/core/cfile.c. The vulnerability allows a local attacker with standard user privileges to cause memory safety violations by manipulating binary loading operations. The defect stems from improper memory management where freed memory is subsequently accessed, leading to heap corruption and potential application termination. The patch commit 635ab1eeb30340c26076722a90cb91fb2272130b addresses the memory handling flaw. CWE-416 (use-after-free) and CWE-119 (improper buffer handling) classify the root causes.

Business impact

For organizations deploying Radare2 as part of malware analysis, vulnerability research, or binary assessment pipelines, this vulnerability creates operational risk. An attacker with local system access could crash the analysis environment, disrupting workflows and potentially causing loss of in-progress analysis or temporary data loss. The low CVSS score indicates no confidentiality or integrity impact; the threat is primarily availability-focused. Organizations relying on Radare2 for security-critical analysis should prioritize stability and consider this vulnerability when assessing tool reliability requirements.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. This includes all installations on Linux, macOS, Windows, and other supported platforms where the vulnerable library version is deployed. Users running newer releases or who have already applied patch 635ab1eeb30340c26076722a90cb91fb2272130b are not affected. Check your installed version via 'radare2 -v' to determine exposure.

Exploitability

Exploitation requires local access and standard user-level privileges; remote exploitation is not possible. The attack surface is limited to scenarios where an attacker can supply or manipulate binary files processed by the r_core_bin_load function. While a public disclosure exists, the practical attack complexity remains moderate because the vulnerability requires specific input conditions and local system access. Organizations with strong local access controls face reduced risk.

Remediation

Apply the patch identified by commit 635ab1eeb30340c26076722a90cb91fb2272130b. Verify against the radare2 project repository or official release notes to confirm the patch version. Upgrade to a patched release if available through your distribution or build from the patched source. For environments where immediate patching is not feasible, restrict local system access and avoid processing untrusted or adversary-controlled binaries with Radare2.

Patch guidance

Verify the currently installed Radare2 version and confirm it does not match the vulnerable range (up to 6.1.6). Review the radare2 GitHub repository and official release announcements to identify the first patched release following the disclosure date of July 6, 2026. The patch commit 635ab1eeb30340c26076722a90cb91fb2272130b provides the technical fix; verify your update includes this commit. Standard package managers may lag behind upstream releases, so check directly with the radare2 project for the latest version if your distribution has not yet published an update.

Detection guidance

Monitor Radare2 process terminations and crashes, particularly those triggered by binary loading operations on untrusted files. Implement audit logging for file access patterns in analysis environments. Intrusion detection systems should flag unusual binary file handling in directories where Radare2 operates. Network-based detection is not applicable due to the local-only attack vector. Log analysis should correlate process crashes with specific input files to identify potential exploitation attempts.

Why prioritize this

This vulnerability merits prompt but not emergency action. The low CVSS score (3.3) and local-only attack requirement reduce immediate risk for most organizations. However, the public disclosure and availability of exploit code justify timely patching to prevent operational disruption and maintain tool stability. Prioritize patching in environments where Radare2 is heavily used or where analysis reliability is mission-critical.

Risk score, explained

CVSS 3.3 (Low severity) reflects the limited scope of impact: local-only attack vector, low privilege requirements, and availability-only consequence (denial of service). The score does not account for confidentiality or integrity breaches because the vulnerability does not enable those attacks. Organizations with strict local access controls or limited Radare2 exposure should weight this lower in their risk portfolio; those relying on Radare2 for continuous security operations should treat it as a moderate operational priority.

Frequently asked questions