CVE-2026-14788: radareorg radare2 cfile.c r_core_bin_load use after free
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function rcorebinload of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radareorg radare2to a version that resolves this vulnerability.Patch 635ab1eeb30340c26076722a90cb91fb2272130b - Compensating control
Because the attack is local and may be exploited for use-after-free in r_core_bin_load (libr/core/cfile.c), restrict local access to radare2 execution to trusted users/contexts (e.g., limit who can run radare2 on affected hosts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14788?
The severity of CVE-2026-14788 is classified as low with a score of 3.3.
What type of vulnerability is CVE-2026-14788?
CVE-2026-14788 is categorized as a use after free vulnerability.
How can CVE-2026-14788 be exploited?
CVE-2026-14788 can be exploited locally by manipulating the function r_core_bin_load.
What versions of radare2 are affected by CVE-2026-14788?
CVE-2026-14788 affects radare2 versions up to and including 6.1.6.
How do I fix CVE-2026-14788?
To fix CVE-2026-14788, upgrade to a version of radare2 that is newer than 6.1.6.