CVE-2026-14787 radareorg CVE debrief

Who should care

Users of radareorg radare2 up to 6.1.6, particularly those with local access to the vulnerable component, should prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of systems utilizing radareorg radare2. The impact of this vulnerability is significant for those with local access, as it could lead to potential exploitation and compromise of affected systems.

Technical summary

The vulnerability is caused by an integer overflow in the cmd_print function of the libr/core/cmd_print.inc library in radareorg radare2 up to 6.1.6. This weakness is part of the pb Print Command Handler component and requires local access to exploit. The attack can lead to potential compromise of affected systems. The exploit has been made publicly available, increasing the risk of attacks. Users should apply the patch 2b6265476c75567006b0fcbb749f4ae7b189c5df to fix the issue.

Defensive priority

Low-Moderate, requiring local access and public exploit availability, suggesting priority focus on systems with elevated risk or exposure to local attacks within the organization, especially where radareorg radare2 is used in development or testing environments with broader network access or sensitive data handling capabilities. Consider compensating controls and enhanced monitoring for potential exploitation attempts in high-risk contexts or where patching may be delayed due to operational constraints or testing requirements. Given the low CVSS score, prioritize based on specific organizational risk assessments and asset criticality, ensuring alignment with existing vulnerability management policies and procedures for prioritization and remediation of vulnerabilities based on risk, impact, and asset sensitivity. The defensive priority should reflect the potential for local exploitation and the availability of public exploits, necessitating a proactive review of current security measures and potential updates to vulnerability management processes to address this specific risk effectively within the organization's security posture and operational capabilities. Therefore, while categorized as Low, it warrants a nuanced approach to prioritization that considers both the CVSS score and the specific operational context of radareorg radare2 deployments within the organization, including the potential impact on critical assets and the likelihood of exploitation based on threat intelligence and historical data related to similar vulnerabilities in the radareorg radare2 component and its usage patterns across the organization. The priority level should guide the allocation of resources for mitigation efforts, ensuring that actions are proportionate to the risk and aligned with organizational risk tolerance and security objectives, particularly in environments where local access could be a significant concern due to insider threats or compromised credentials. Consequently, a Low-Moderate priority reflects the need for balanced consideration between the CVSS score and the operational, security, and risk management context of radareorg radare2 usage within the organization,

Recommended defensive actions

• Apply the patch 2b6265476c75567006b0fcbb749f4ae7b189c5df to fix the issue
• Restrict access to the vulnerable component
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-06T02:16:21.360Z and was last modified on 2026-07-09T15:25:14.967Z. The source details indicate a weakness in radareorg radare2 up to 6.1.6, specifically in the cmd_print function of the libr/core/cmd_print.inc library, which is part of the pb Print Command Handler component. This weakness leads to an integer overflow. The attack requires local access, and the exploit has been made publicly available, potentially leading to attacks. The patch name is 2b6265476c75567006b0fcbb749f4ae7b189c5df. Evidence is limited to CVE and NVD details.

Official resources