CVE-2026-14759: radare2 from 6.1.0 (inclusive), before 6.1.8 (exclusive), 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6

Affected technology

radare2 · from 6.1.0 (inclusive), before 6.1.8 (exclusive)
radare

radare2 · 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6
radareorg

Description’s affected range: up to 6.1.6

Component: RBinJava Line Number Table Parser
Function: r_bin_java_inner_classes_attr_calc_size
File: shlr/java/class.c

Attack conditions (VulDB, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 1.9/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.