Description
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
Published: 2026-07-05
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a use-after-free flaw in radareorg’s radare2, triggered in the r_core_seek_arch_bits function of the regprofile handler. An attacker with local file access can manipulate the function so that a freed pointer is dereferenced, resulting in memory corruption of the process.

Affected Systems

The flaw affects radare2 releases up to and including version 6.1.6. Any installation of those versions is vulnerable. The patch that resolves the issue is identified by commit 8b25c773785d85cb0103410a0905089d286921c2, and can be incorporated by rebuilding from the latest source tree.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity, while an EPSS score of less than 1% suggests that the probability of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. An exploit is publicly available and requires only local privileges; any user with write access to a radare2 installation could trigger the flaw, leading to memory corruption of the process.

Generated by OpenCVE AI on July 23, 2026 at 15:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update radare2 to a version that includes commit 8b25c773785d85cb0103410a0905089d286921c2, or rebuild the binary from the latest source after applying the patch.
  • If an immediate upgrade is not possible, apply the patch from the commit directly to the source tree and recompile the binary.
  • Restrict local execution of radare2 to trusted users and consider disabling the regprofile handler or the r_core_seek_arch_bits function if it is not required for your workflow.

Generated by OpenCVE AI on July 23, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.
Title radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
First Time appeared Radareorg
Radareorg radare2
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*
Vendors & Products Radareorg
Radareorg radare2
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Radareorg Radare2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T15:40:58.650Z

Reserved: 2026-07-04T16:19:36.825Z

Link: CVE-2026-14760

cve-icon Vulnrichment

Updated: 2026-07-06T15:40:28.726Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-05T15:30:08Z

Links: CVE-2026-14760 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:45:02Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free

  • CWE-825

    Expired Pointer Dereference