Description
A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
Published: 2026-07-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local integer overflow flaw exists in radare2’s cmd_print function within the cmd_print.inc component, allowing malformed input to that can lead to program crashes or unintended memory corruption. The weakness is categorized as CWE-189 and CWE-190 and does not provide privilege escalation or remote code execution capabilities.

Affected Systems

The affected product is radareorg radare2 version 6.1.6 and earlier. The official patch commit 2b6265476c75567006b0fcbb749f4ae7b189c5df issue. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity for a local exploit. The EPSS score of < 1% shows a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local execution or direct interaction with radare2, and although a public vector is described. Consequently, the potential impact is limited to program crashes or memory corruption rather than escalation or remote compromise.

Generated by OpenCVE AI on July 23, 2026 at 15:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch commit 2b6265476c75567006b0fcbb749f4ae7b189c5df
  • Restrict local execution of radare2 to trusted users or enforce role-based access controls
  • Enforce input validation by ensuring bounds checks in cmd_print prevent integer overflows
  • Monitor system logs for abnormal cmd_print usage or crashes that might indicate exploitation attempts

Generated by OpenCVE AI on July 23, 2026 at 15:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.
Title radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow
First Time appeared Radareorg
Radareorg radare2
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:radareorg:radare2:*:*:*:*:*:*:*:*
Vendors & Products Radareorg
Radareorg radare2
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Radareorg Radare2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:49:15.165Z

Reserved: 2026-07-05T16:03:16.568Z

Link: CVE-2026-14787

cve-icon Vulnrichment

Updated: 2026-07-06T16:35:55.301Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:30:04Z

Weaknesses