CVE-2026-14789

LOW

radareorg radare2 Memory64ListStream mdmp.c stack-based overflow

Title source: cna
STIX 2.1

Description

A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-376378 | radareorg radare2 Memory64ListStream mdmp.c stack-based overflow
https://vuldb.com/vuln/376378
Signature, Permissions Required signature permissions-required
VDB-376378 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/376378/cti
Third Party Advisory third-party-advisory
CVE-2026-14789 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14789
Third Party Advisory third-party-advisory
Submit #850389 | radareorg radare2 6.1.6 Improper Input Validation
https://vuldb.com/submit/850389
Exploit exploit issue-tracking
https://github.com/radareorg/radare2/issues/26051

Scores

CVSS v3 3.3
EPSS 0.0013
EPSS Percentile 2.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-121
Status published
Products (7)
radareorg/radare2 6.1.0
radareorg/radare2 6.1.1
radareorg/radare2 6.1.2
radareorg/radare2 6.1.3
radareorg/radare2 6.1.4
radareorg/radare2 6.1.5
radareorg/radare2 6.1.6
Published Jul 06, 2026
Tracked Since Jul 06, 2026