CVE-2026-14786 Overview
CVE-2026-14786 is an integer overflow vulnerability in the radare2 reverse engineering framework maintained by radareorg. The flaw affects versions up to and including 6.1.6. It resides in the r_str_word_get0set function within libr/util/str.c, where improper handling of size calculations leads to an integer overflow condition [CWE-189]. Exploitation requires local access and low privileges. The vendor has published a fix in commit 11ac224c0eb8d57830fccc99e1c1cd8e5d958813. Public exploit code has been referenced in the associated advisory, though impact is limited to availability.
Critical Impact
Local attackers can trigger an allocation size overflow in radare2's string handling routine, resulting in a crash of the analysis process and denial of service.
Affected Products
- radare radare2 versions up to 6.1.6
- Component: libr/util/str.c — function r_str_word_get0set
- Reported in GitHub Issue #26047
Discovery Timeline
- 2026-07-06 - CVE-2026-14786 published to NVD
- 2026-07-07 - Last updated in NVD database
- Patch commit - 11ac224c0eb8d57830fccc99e1c1cd8e5d958813 merged into the radare2 repository
Technical Details for CVE-2026-14786
Vulnerability Analysis
The vulnerability exists in r_str_word_get0set, a utility function that replaces a word within a delimited string buffer. The routine computes allocation sizes based on the lengths of the input string, the target word, and the replacement string. When these length values are combined without proper bounds checks, the resulting sum can wrap past INT_MAX, producing an undersized allocation. Subsequent copy operations then write beyond the allocated buffer, causing a crash. The condition is triggered by supplying crafted input to any radare2 workflow that invokes this string helper.
Root Cause
The root cause is unchecked arithmetic on the int length variables alen, blen, and nlen used to derive the size passed to memory allocation. When attacker-controlled string lengths approach integer boundaries, the additive computation overflows. The patch addresses this by restructuring the function to remove the vulnerable length arithmetic path, as shown in the upstream commit.
Attack Vector
Exploitation requires local access. An attacker delivers a malicious input file, script, or command to a radare2 session — for example, through automated analysis pipelines or shared reverse engineering projects — that causes the tool to invoke r_str_word_get0set with oversized parameters. The result is a process crash, degrading the availability of analyst workflows and any CI systems that call radare2 for binary triage.
// Patch excerpt from libr/util/str.c
R_API char *r_str_word_get0set(char *stra, int stralen, int idx, const char *newstr, int *newlen) {
char *p = NULL;
char *out;
- int alen, blen, nlen;
if (!stra && !newstr) {
return NULL;
}
Source: radare2 commit 11ac224c. The removed alen, blen, and nlen declarations mark the arithmetic path that produced the overflow.
Detection Methods for CVE-2026-14786
Indicators of Compromise
- Unexpected crashes or SIGABRT/SIGSEGV termination of radare2, r2, or rasm2 processes during file analysis.
- Core dumps referencing r_str_word_get0set or libr/util/str.c in the backtrace.
- Repeated invocation of radare2 with abnormally large string or word-index arguments in shell history or CI logs.
Detection Strategies
- Inventory hosts running radare2 and compare installed versions against 6.1.6 or earlier using package management queries.
- Enable core dumps in analysis environments and inspect for stack frames touching r_str_word_get0set to identify triggered instances.
- Review automated binary analysis pipelines for radare2 invocations that terminate abnormally on specific input samples.
Monitoring Recommendations
- Monitor process termination events for radare2 binaries on analyst workstations and CI runners.
- Track file access patterns that precede radare2 crashes to identify malicious samples that trigger the overflow.
- Alert on new radare2 installations that fall below the patched commit revision.
How to Mitigate CVE-2026-14786
Immediate Actions Required
- Upgrade radare2 to a build that includes commit 11ac224c0eb8d57830fccc99e1c1cd8e5d958813 or later.
- Restrict local access to systems running vulnerable radare2 versions to trusted users only.
- Rebuild any container images or analyst VMs that ship radare2 from source or distribution packages predating the fix.
Patch Information
The vendor has published a patch in the official radare2 commit, which addresses GitHub Issue #26047. Additional advisory context is available at the VulDB entry for CVE-2026-14786. Users should pull the latest master branch or wait for a tagged release beyond 6.1.6.
Workarounds
- Avoid processing untrusted binaries or scripts with vulnerable radare2 versions until the patch is applied.
- Run radare2 in a sandboxed or containerized environment with resource limits to contain crashes.
- Disable or gate automated analysis pipelines that pass externally sourced input to radare2 until upgraded.
# Verify installed radare2 version and upgrade from source
r2 -v
git clone https://github.com/radareorg/radare2.git
cd radare2
git log --oneline | grep 11ac224c
sys/install.sh
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
