CVE-2026-14757: radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-05 · updated 2026-10-25
Weakness: CWE-189

Description

A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.

Affected products

radareorg/radare2: from 6.1.0 before 6.1.8 — fixed in 6.1.8

How to fix

Upgrade to a fixed version: radareorg/radare2 6.1.8. Check the vendor advisory for mitigations.

References

https://github.com/radareorg/radare2/
https://github.com/radareorg/radare2/issues/26041
https://vuldb.com/cve/CVE-2026-14757
https://vuldb.com/submit/850381
https://vuldb.com/vuln/376346
https://vuldb.com/vuln/376346/cti

Get alerted when CVE-2026-14757 or the next vulnerability affects your stack