Log in Start free

Vulnerability · Published Jul 6, 2026 · Assigned by VulDB

CVE-2026-14788radareorg radare2 cfile.c r_core_bin_load use after free

Low 3.3

In plain English

A low-severity use-after-free in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:25.10radare2no fix listedUBUNTU-CVE-2026-14788
Ubuntu:26.04:LTSradare2no fix listedUBUNTU-CVE-2026-14788
Ubuntu:26.10radare2no fix listedUBUNTU-CVE-2026-14788

Affected products (as reported)

VendorProductVersions
radareorg radare2 6.1.06.1.16.1.26.1.36.1.46.1.56.1.6

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References