CVE-2026-14760
Received Received - Intake

Use After Free in radare2 Due to regprofile Handler

Publication date: 2026-07-05

Last updated on: 2026-07-05

Assigner: VulDB

Description
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-05
Last Modified
2026-07-05
Generated
2026-07-05
AI Q&A
2026-07-05
EPSS Evaluated
N/A
NVD
CVE-2026-14760
EUVD
EUVD-2026-41770

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
radareorg radare2 to 6.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14760 is a use-after-free vulnerability in radareorg radare2 up to version 6.1.6, specifically in the function r_core_seek_arch_bits within the file libr/core/disasm.c. The issue occurs when the pde disassembly path resets the register profile during execution, causing the program to access a previously freed register item. This leads to a heap-use-after-free error, which can be triggered locally by executing the pde command with a bitness hint.

The vulnerability arises because the code does not properly refresh or invalidate cached register pointers after a profile-changing seek or bitness operation, resulting in unsafe memory access.

Impact Analysis

This vulnerability can lead to memory corruption through a use-after-free condition, which may cause crashes or undefined behavior in radare2 when exploited.

Since the exploit requires local access, an attacker with local privileges could leverage this flaw to destabilize the application or potentially execute arbitrary code, depending on the context and further exploitation.

The vulnerability has been publicly disclosed and a proof-of-concept exploit is available, increasing the risk of attacks if the software is not patched.

Detection Guidance

The vulnerability can be detected by running radare2 with specific commands that trigger the use-after-free condition in the disassembly process. Specifically, executing the `pde` command with a bitness hint, such as `ahb 16 @ 0x5`, causes the vulnerable function `r_core_seek_arch_bits()` to reset the register profile, which leads to the use-after-free error.

Using AddressSanitizer (ASan) during this operation can help detect the heap-use-after-free error in `r_reg_get_value`.

  • Run radare2 with a test file and execute the command: `pde` with a bitness hint, for example: `ahb 16 @ 0x5`.
  • Monitor the output for AddressSanitizer errors indicating use-after-free reads.
Mitigation Strategies

The immediate mitigation step is to apply the patch identified by commit 8b25c773785d85cb0103410a0905089d286921c2, which fixes the use-after-free vulnerability by safely refreshing the program counter register during disassembly.

Until the patch is applied, avoid running the vulnerable `pde` command with bitness hints that trigger the issue, especially in environments where local access is possible.

Additionally, restrict local access to radare2 installations to trusted users only, as the exploit requires local access.

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart