CVE-2026-14760

EUVD-2026-41770
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.79%
Affected Products (NVD)
VendorProductVersion
radareradare2
6.1.0 ≤
𝑥
< 6.1.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
radare2
sid
6.1.8+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
radare2
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage