CVE-2026-14760: radare2 from 6.1.0 (inclusive), before 6.1.8 (exclusive), 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6

Affected technology

radare2 · from 6.1.0 (inclusive), before 6.1.8 (exclusive)
radare

radare2 · 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6
radareorg

Description’s affected range: up to 6.1.6

Component: regprofile Handler
Function: r_core_seek_arch_bits
File: libr/core/disasm.c

Attack conditions (VulDB, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges could trigger a use-after-free error. VulDB’s CVSS 4.0 assessment (base score 1.9/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not state a further attacker outcome.