CVE-2026-14758 radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow

Medium 4.8 Published 5 Jul 2026 Updated 6 Jul 2026

A local attacker can trigger an integer overflow in radare2's hexpairs parser, potentially causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-14758?

CVE-2026-14758 is a medium-severity vulnerability in Radare Radare2, published on 5 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.

Weakness: CWE-190, CWE-189

Which versions are affected by CVE-2026-14758?

It affects 1 product.

Products include Radare Radare2.

How do I fix CVE-2026-14758?

Apply the vendor's patch.

Is CVE-2026-14758 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14758 exists.

All Radare Radare2 vulnerabilities

Sources

Also known as GHSA-f973-xj97-7vpp, UBUNTU-CVE-2026-14758.