Log in Start free

Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14760radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free

Low 3.3

In plain English

A low-severity use-after-free in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:25.10radare2no fix listedUBUNTU-CVE-2026-14760
Ubuntu:26.04:LTSradare2no fix listedUBUNTU-CVE-2026-14760
Ubuntu:26.10radare2no fix listedUBUNTU-CVE-2026-14760

Affected products (as reported)

VendorProductVersions
radareorg radare2 6.1.06.1.16.1.26.1.36.1.46.1.56.1.6

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References