CVE-2026-14761 radareorg radare2 str.c r_str_append integer overflow

Medium 4.8 Published 5 Jul 2026 Updated 6 Jul 2026

An integer overflow in radare2's string handling allows local attackers to cause denial of service or potentially execute code.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-14761?

CVE-2026-14761 is a medium-severity vulnerability in Radare Radare2, published on 5 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.

Weakness: CWE-190, CWE-189

Which versions are affected by CVE-2026-14761?

It affects 1 product.

Products include Radare Radare2.

How do I fix CVE-2026-14761?

Apply the vendor's patch.

Is CVE-2026-14761 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14761 exists.

All Radare Radare2 vulnerabilities

Sources

Also known as GHSA-q4m4-82h9-qfgv, UBUNTU-CVE-2026-14761.