CVE-2026-14760

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14760
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14760.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14760
Downstream
Published
2026-07-05T15:30:08.954Z
Modified
2026-07-11T04:03:49.605626305Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
Details

A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function rcoreseekarchbits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.1.1"
                },
                {
                    "last_affected": "6.1.1"
                },
                {
                    "introduced": "6.1.3"
                },
                {
                    "last_affected": "6.1.3"
                },
                {
                    "introduced": "6.1.5"
                },
                {
                    "last_affected": "6.1.5"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14760.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/radareorg/radare2

Affected ranges

Type
GIT
Repo
https://github.com/radareorg/radare2
Events
Introduced
c3d11822fde49cbc9af338bbc54ad050d00f8a80
Fixed
d904d02e1157b45135c6e61651d890bac8abe873
Fixed
8b25c773785d85cb0103410a0905089d286921c2
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.1.0"
        },
        {
            "fixed": "6.1.8"
        }
    ]
}

Affected versions

6.*
6.1.0
6.1.2
6.1.4
6.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14760.json"