CVE-2026-14789: Stack Buffer Overflow in Radare2 Memory Dump Parser

Technical summary

CVE-2026-14789 is a stack-based buffer overflow (CWE-119, CWE-121) in the Memory64ListStream Parser within libr/bin/format/mdmp/mdmp.c. The vulnerability allows an authenticated local user to overflow a stack buffer by supplying a malformed MDMP (Memory Dump) file. The attack vector is local with low privileges required and no user interaction. The impact is limited to availability—successful exploitation results in denial of service through application termination rather than code execution or information disclosure.

Business impact

For organizations using radare2 as part of their reverse-engineering, malware analysis, or binary forensics workflows, this vulnerability introduces a stability risk. An analyst processing untrusted or adversarial memory dump files could experience unplanned tool crashes, disrupting investigation timelines. The LOW severity and DoS-only impact mean this is unlikely to compromise investigation data or enable lateral movement, but it may frustrate incident response operations during critical analysis windows.

Affected systems

Radare2 versions up to and including 6.1.6 are affected. The vulnerability is triggered through the Memory64ListStream Parser when processing MDMP format files. Any deployment or workflow in which radare2 processes external or untrusted MDMP input is at risk. Check your installed radare2 version with 'radare2 -v' or equivalent; if below the patched commit, update immediately.

Exploitability

Exploitation requires local system access and the ability to place or influence a malformed MDMP file that radare2 will parse. The exploit is now public, meaning proof-of-concept information is available and the attack surface is well-understood. However, the attack is not remotely triggerable and demands intentional file manipulation, limiting casual exploitation. Sandboxed or air-gapped analysis environments that control input files face lower risk than open-access lab systems where analysts process crowd-sourced samples.

Remediation

Update radare2 to a version that includes commit 175d4addb68981331c85b10681c2161c38fb5762 or later. Verify the patch is present in your installed version. If you cannot immediately update, implement file-level controls: restrict who can supply MDMP files for analysis, validate file provenance, and consider processing untrusted dumps in isolated virtual environments to limit crash impact.

Patch guidance

The fix is available in radare2 commits after 175d4addb68981331c85b10681c2161c38fb5762. Consult the radare project's official repository or release notes to identify the first stable or development build containing this commit. Most package managers (apt, brew, pacman) will offer updated radare2 versions—check for version numbers post-6.1.6 in your distribution's repository or build from source using the patched commit.

Detection guidance

Monitor radare2 process exits and crashes, especially when parsing MDMP files from external sources. Log file access to radare2 analysis directories and alert on unexpected MDMP processing of suspicious or unvalidated samples. If possible, integrate memory dump validation or sanitization before passing to radare2. IDS/IPS signatures for malformed MDMP headers may help detect adversarial file delivery attempts in networked scenarios, though this vulnerability is primarily local.

Why prioritize this

Although the CVSS score is LOW (3.3), the public availability of exploits and the presence of a known, straightforward fix warrant near-term remediation. The vulnerability does not enable privilege escalation or remote access, and the impact is limited to tool availability rather than data compromise. However, any analyst or incident responder who regularly processes untrusted binaries should prioritize the update to avoid analysis-time disruptions.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects a local attack vector requiring low privileges, no user interaction, and an impact limited to availability (application denial of service). There is no confidentiality or integrity impact. The score is mechanically accurate but should be contextualized: in a shared or open-lab environment where analysts process external samples, the practical risk is modestly elevated compared to a locked-down forensics workstation. Organizations should not deprioritize patching simply because the numeric score is low—the public exploit and high prevalence of radare2 in security teams argue for timely updates.

Frequently asked questions