CVE-2026-14761: Radare2 Buffer Overflow Vulnerability

CVE-2026-14761 Overview

CVE-2026-14761 is an integer overflow vulnerability in radare2, the open-source reverse engineering framework maintained by radareorg. The flaw resides in the r_str_ndup and r_str_append functions within libr/util/str.c and affects versions up to 6.1.6. The manipulation of length parameters leads to an integer overflow condition that can crash the application. Exploitation requires local access with low privileges, and the issue has been publicly disclosed. The maintainers have committed a patch identified by hash a20a56917ae85d732e683f8d9078bdcfee92446c to remediate the issue.

Critical Impact
A local attacker supplying crafted input to radare2 string handling routines can trigger an integer overflow, resulting in a crash and potential availability loss for the analysis tool.

Affected Products

radare2 versions up to and including 6.1.6
libr/util/str.c string manipulation utilities
Any downstream tooling embedding vulnerable radare2 libraries

Discovery Timeline

2026-07-05 - CVE-2026-14761 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14761

Vulnerability Analysis

The vulnerability is classified under [CWE-189] (Numeric Errors) and stems from unsafe arithmetic during string length calculations in radare2 utility functions. When r_str_append or r_str_ndup compute a combined buffer size from two signed integer lengths, the sum can wrap around and produce a value smaller than either operand. This truncated length is then passed to realloc, resulting in an undersized allocation followed by out-of-bounds writes via memmove. The end result is a crash or memory corruption during string manipulation operations, which are frequently executed when radare2 parses binaries, symbols, or user-supplied input.

Root Cause

The original implementation stored string lengths in int variables. Concatenating two large strings produced a signed integer overflow before the allocation call. The patch converts the length variables to size_t, hardens the realloc failure path to free the original buffer, and prevents the arithmetic wrap that led to the crash.

Attack Vector

An attacker must have local access to a host running radare2 and the ability to influence a string argument, typically by supplying a malicious binary, script, or command input for analysis. Because radare2 is often used to triage untrusted samples, a crafted input file is a realistic delivery vector for triggering the overflow in r_str_append.

 }
 
 R_API char *r_str_prepend(char *ptr, const char *string) {
-	int slen, plen;
 	if (!ptr) {
 		return strdup (string);
 	}
-	plen = strlen (ptr);
-	slen = strlen (string);
-	ptr = realloc (ptr, slen + plen + 1);
-	if (!ptr) {
+	size_t plen = strlen (ptr);
+	size_t slen = strlen (string);
+	char *newptr = realloc (ptr, slen + plen + 1);
+	if (!newptr) {
+		free (ptr);
 		return NULL;
 	}
+	ptr = newptr;
 	memmove (ptr + slen, ptr, plen + 1);
 	memmove (ptr, string, slen);
 	return ptr;

Source: GitHub Commit a20a5691 — the patch replaces signed int length variables with unsigned size_t and adds a free on the realloc failure path.

Detection Methods for CVE-2026-14761

Indicators of Compromise

Unexpected crashes or aborts of the radare2 or r2 process on analyst workstations
Core dumps or ASan reports referencing r_str_append, r_str_ndup, or r_str_prepend in libr/util/str.c
Analysis of untrusted binaries producing abnormally large embedded strings before the crash

Detection Strategies

Inventory endpoints for installed radare2 versions and flag any build at or below 6.1.6 lacking commit a20a56917ae85d732e683f8d9078bdcfee92446c
Monitor process telemetry for repeated segmentation faults originating from radare2 executables
Review sample submission pipelines and sandboxes for crash logs that match the vulnerable code path

Monitoring Recommendations

Enable core dump collection on reverse engineering workstations to capture crash artifacts for triage
Aggregate radare2 exit codes and stderr output in centralized logging for correlation
Track file provenance of samples opened in radare2 to identify the source of crash-inducing inputs

How to Mitigate CVE-2026-14761

Immediate Actions Required

Upgrade radare2 to a build that includes commit a20a56917ae85d732e683f8d9078bdcfee92446c or later
Restrict use of vulnerable radare2 versions to isolated analysis environments
Avoid opening untrusted binaries with unpatched radare2 installations

Patch Information

The fix is available in the upstream radareorg/radare2 repository as commit a20a56917ae85d732e683f8d9078bdcfee92446c. The patch converts signed int length variables to size_t in r_str_append, r_str_ndup, and r_str_prepend, and hardens the realloc failure handling. Distribution package maintainers should rebuild radare2 packages against a source tree that includes this commit. Refer to the radare2 GitHub repository and the issue discussion for build guidance.

Workarounds

Run radare2 inside a sandboxed virtual machine or container to contain crashes
Limit local user privileges on hosts where radare2 is installed to reduce lateral impact
Pre-screen samples with size limits to reduce likelihood of triggering the overflow

bash

# Build patched radare2 from source
git clone https://github.com/radareorg/radare2.git
cd radare2
git checkout a20a56917ae85d732e683f8d9078bdcfee92446c
sys/install.sh
r2 -v