Description
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.
References (7)
Core 7
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-376350 | radareorg radare2 str.c r_str_append integer overflow
https://vuldb.com/vuln/376350
Signature, Permissions Required signature
permissions-required
VDB-376350 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/376350/cti
Third Party Advisory third-party-advisory
CVE-2026-14761 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14761
Third Party Advisory third-party-advisory
Submit #850385 | radareorg radare2 6.1.6 Integer Overflow
https://vuldb.com/submit/850385
Exploit exploit
issue-tracking
https://github.com/radareorg/radare2/issues/26045
Product product
https://github.com/radareorg/radare2/
Scores
CVSS v3
3.3
EPSS
0.0013
EPSS Percentile
3.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-189
CWE-190
Status
published
Products (8)
radare/radare2
< 6.1.8
radareorg/radare2
6.1.0
radareorg/radare2
6.1.1
radareorg/radare2
6.1.2
radareorg/radare2
6.1.3
radareorg/radare2
6.1.4
radareorg/radare2
6.1.5
radareorg/radare2
6.1.6
Published
Jul 05, 2026
Tracked Since
Jul 05, 2026