CVE-2026-14758
published 2026-07-05CVE-2026-14758: A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
3.1th percentile
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| radare | radare2 | >= 6.1.0 < 6.1.8 | 6.1.8 |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
| radareorg | radare2 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A vulnerability was identified in radareorg radare2 up to 6.1.6.
ghsa_unreviewed·2026-07-05
CVE-2026-14758 [LOW] A vulnerability was identified in radareorg radare2 up to 6.1.6.
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
VulDB
radareorg radare2 up to 6.1.6 hexpairs Parser libr/core/cmd_anal.inc.c cmd_anal_opcode integer overflow (Issue 26042)
vuldb·2026-07-04
CVE-2026-14758 [LOW] radareorg radare2 up to 6.1.6 hexpairs Parser libr/core/cmd_anal.inc.c cmd_anal_opcode integer overflow (Issue 26042)
A vulnerability described as problematic has been identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow.
This vulnerability is documented as CVE-2026-14758. The attack needs to be performed locally. Additionally, an exploit exists.
A patch should be applied to remediate this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [epel-all]
bugzilla·2026-07-06·CVSS 3.3
CVE-2026-14758 [LOW] CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [epel-all]
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
Bugzilla
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [fedora-all]
bugzilla·2026-07-06·CVSS 3.3
CVE-2026-14758 [LOW] CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [fedora-all]
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
Bugzilla
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser
bugzilla·2026-07-05·CVSS 3.3
CVE-2026-14758 [LOW] CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser
CVE-2026-14758 radare2: radare2: Denial of Service via integer overflow in hexpairs parser
A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.
2026-07-05
Published