CVE-2026-14788
Received Received - Intake

Use After Free in radare2

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: VulDB

Description
A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-06
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-14788
EUVD
EUVD-2026-41799

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
radareorg radare2 to 6.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the radare2 software, specifically in the function r_core_bin_load within the file libr/core/cfile.c. It occurs when the cmd.load command closes the current IO descriptor during binary loading, but the r_core_bin_load function continues to use a cached pointer to that descriptor which has already been freed. This improper handling leads to accessing memory that has been freed, causing potential crashes or undefined behavior.

The fix involves safely managing the file descriptor and related resources by introducing safe handling of filename URIs, adding checks for descriptor states, and ensuring proper cleanup to prevent premature access to freed memory.

Impact Analysis

This vulnerability can lead to a use-after-free condition which may cause the radare2 application to crash or behave unpredictably when loading binaries. Since the attack requires local access, an attacker with local privileges could exploit this to cause denial of service or potentially execute arbitrary code depending on the context.

Detection Guidance

This vulnerability is a use-after-free issue in the r_core_bin_load function of radare2 and requires local exploitation. Detection involves reproducing the issue using the provided proof-of-concept (PoC) script and test file.

  • Run the provided PoC script named run_cmdload_close_cli.sh to trigger the vulnerability.
  • Use the test file probe.elf with the PoC script to observe the heap-use-after-free read error.
  • Monitor for AddressSanitizer (ASan) reports indicating heap-use-after-free errors at libr/core/cfile.c:782:14.
Mitigation Strategies

The primary mitigation step is to apply the official patch that fixes the use-after-free vulnerability in radare2.

  • Update radare2 to include the patch identified by commit 635ab1eeb30340c26076722a90cb91fb2272130b.
  • Ensure that the patched version properly manages IO descriptors and prevents use-after-free conditions during binary loading.
  • Avoid running untrusted binaries or commands locally with radare2 until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart