Description
A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
Published: 2026-07-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An integer overflow occurs within radare2’s cmd_print function, triggered by malformed input to the cmd_print.inc component. The flaw is classified as CWE-189 and CWE-190 and can cause the program to crash or write beyond intended bounds, potentially corrupting memory. The vulnerability is local in nature and does not provide a direct means to elevate privileges or execute code remotely.

Affected Systems

The only affected product is radareorg radare2, versions 6.1.6 and earlier. The vulnerability is present in the cmd_print function across these releases, and no other vendors or products have been reported as affected.

Risk and Exploitability

The CVSS score of 4.8 reflects moderate severity for a local exploit, while the EPSS score of <1% indicates a very low likelihood of current exploitation. The vulnerability is not catalogued in CISA’s KEV. Because the attack vector requires local execution and direct interaction with radare2, the potential impact is limited to program instability and memory corruption rather than broader system compromise.

Generated by OpenCVE AI on August 1, 2026 at 19:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch commit 2b6265476c75567006b0fcbb749f4ae7b189c5df
  • Restrict radare2 execution to trusted users or enforce role-based access controls
  • Ensure the cmd_print implementation performs bounds checking to safeguard against integer overflows
  • Monitor system logs for anomalous crashes or abnormal input patterns that might indicate exploitation attempts

Generated by OpenCVE AI on August 1, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
Title radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow
First Time appeared Radareorg
Radareorg radare2
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*
Vendors & Products Radareorg
Radareorg radare2
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Radare Radare2
Radareorg Radare2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:49:15.165Z

Reserved: 2026-07-05T16:03:16.568Z

Link: CVE-2026-14787

cve-icon Vulnrichment

Updated: 2026-07-06T16:35:55.301Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-06T02:16:21.360

Modified: 2026-07-09T15:25:14.967

Link: CVE-2026-14787

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T19:15:04Z

Weaknesses