Log in Start free

Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14758radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow

Low 3.3

In plain English

A low-severity integer overflow in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 91.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:25.10radare2no fix listedUBUNTU-CVE-2026-14758
Ubuntu:26.04:LTSradare2no fix listedUBUNTU-CVE-2026-14758
Ubuntu:26.10radare2no fix listedUBUNTU-CVE-2026-14758

Affected products (as reported)

VendorProductVersions
radareorg radare2 6.1.06.1.16.1.26.1.36.1.46.1.56.1.6

Weakness: CWE-190, CWE-189 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References