{"kind": "product", "path": "vulns/ubuntu-26.10/radare2", "name": "radare2", "product": "radare2", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-112077", "noindex": false, "published": "2026-10-19T04:15:17.808Z", "modified": "2026-10-22T02:34:10.802Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "severity": "medium", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112077", "title": "radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism", "description": "A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is assessed as difficult. Upgrading to version 6.2.4 is capable of addressing this issue. The patch is named 18fd12efa98a7d1977de7bdd379d8a848777b90f. Upgrading the affected component is recommended. The pre-requisite of the vulnerability is reflected by the CVSS ve", "references": ["https://vuldb.com/vuln/421756", "https://vuldb.com/vuln/421756/cti", "https://vuldb.com/cve/CVE-2026-112077"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81883", "noindex": false, "published": "2026-09-22T15:14:47.022Z", "modified": "2026-09-22T16:11:40.440Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81883", "title": "radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a function-name string without checking the remaining buffer length. The vulnerability is triggered by opening or inspecting a crafted Lua 5.3 bytecode file whose function-name string ends at the input-buffer boundary. The parser read two integers and three one-byte fields beyond the allocated input buffer. This can cause invalid parser results or process termination; no attacker-observable memo", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-96m5-hvwp-674c", "https://github.com/radareorg/radare2/issues/26228", "https://github.com/radareorg/radare2/commit/26c2eac360033458e9d266e5e30667d1f8d642e3"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81885", "noindex": false, "published": "2026-09-22T15:13:53.969Z", "modified": "2026-09-25T23:31:00.634Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00165, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81885", "title": "radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0.", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-43wr-4j49-rcxj", "https://github.com/radareorg/radare2/issues/26225", "https://github.com/radareorg/radare2/pull/26192"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81882", "noindex": false, "published": "2026-09-22T15:12:49.907Z", "modified": "2026-09-28T16:32:29.291Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81882", "title": "radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. ", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-r5cr-f9p6-5pvj", "https://github.com/radareorg/radare2/issues/26227", "https://github.com/radareorg/radare2/commit/38d82a949626dba3783f40508bb66179e631fa45"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81886", "noindex": false, "published": "2026-09-22T15:11:36.343Z", "modified": "2026-09-22T17:44:33.102Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00165, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81886", "title": "radare2: Uncontrolled memory allocation in radare2 dmp64 parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size. This can cause denial of service through excessive memory consumption and processing time. This issue is fixed in version 6.2.0.", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-3xrx-wh64-8xr8", "https://github.com/radareorg/radare2/issues/26224", "https://github.com/radareorg/radare2/pull/26180"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81884", "noindex": false, "published": "2026-09-22T15:10:43.501Z", "modified": "2026-09-22T15:40:10.955Z", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81884", "title": "radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered by opening a crafted Mach-O file while the non-default bin.verbose option is enabled. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated buffer. This can cause a heap out-of-bounds read and possible process termination; no attacker-observable memory disclosure has been demonstrated. This issue i", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-c2g2-2mc7-3x5w", "https://github.com/radareorg/radare2/issues/26226", "https://github.com/radareorg/radare2/pull/26193"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81880", "noindex": false, "published": "2026-09-22T15:09:48.887Z", "modified": "2026-09-25T23:29:33.839Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00139, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81880", "title": "radare2: Uncontrolled resource consumption in radare2 PEF loader", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged proc", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-fg6f-rj8g-25pq", "https://github.com/radareorg/radare2/commit/87c780e29ee6251cebaab51585d14482cb7740ac", "https://github.com/radareorg/radare2/releases/tag/6.2.0"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81879", "noindex": false, "published": "2026-09-22T15:09:01.910Z", "modified": "2026-09-22T15:38:46.170Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00182, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81879", "title": "radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array. This can cause a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution ha", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-jqfq-hvcp-xh4p", "https://github.com/radareorg/radare2/issues/26223", "https://github.com/radareorg/radare2/pull/26178"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81878", "noindex": false, "published": "2026-09-22T15:07:45.225Z", "modified": "2026-09-22T17:55:51.200Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00202, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81878", "title": "radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation. This can cause heap memory corruption and denial of service; arbitrary code execution is possible bu", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-9phv-v2w8-56j3", "https://github.com/radareorg/radare2/issues/26222", "https://github.com/radareorg/radare2/pull/26177"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-81881", "noindex": false, "published": "2026-09-22T15:05:21.940Z", "modified": "2026-09-22T17:44:38.856Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81881", "title": "radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser", "description": "radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical index. The vulnerability is triggered by parsing Swift type and class metadata from a crafted Mach-O file. The derived index was used to read four bytes immediately before the allocated field-metadata buffer. This can cause incorrect metadata processing or process termination; no attacker-observable memory disclosure has been demonstrated. This issue is f", "references": ["https://github.com/radareorg/radare2/security/advisories/GHSA-q4w7-225g-64j9", "https://github.com/radareorg/radare2/issues/26229", "https://github.com/radareorg/radare2/commit/1da6e782df220edf56138ef5fe4f33745b04db74"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14789", "noindex": false, "published": "2026-07-06T02:00:10.294Z", "modified": "2026-07-06T12:59:10.100Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00222, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14789", "title": "radareorg radare2 Memory64ListStream mdmp.c stack-based overflow", "description": "A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to address this issue.", "references": ["https://vuldb.com/vuln/376378", "https://vuldb.com/vuln/376378/cti", "https://vuldb.com/cve/CVE-2026-14789"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14788", "noindex": false, "published": "2026-07-06T01:45:08.467Z", "modified": "2026-07-06T13:05:50.219Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14788", "title": "radareorg radare2 cfile.c r_core_bin_load use after free", "description": "A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is advised to resolve this issue.", "references": ["https://vuldb.com/vuln/376377", "https://vuldb.com/vuln/376377/cti", "https://vuldb.com/cve/CVE-2026-14788"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14787", "noindex": false, "published": "2026-07-06T01:30:09.280Z", "modified": "2026-07-06T16:49:15.165Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00205, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14787", "title": "radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow", "description": "A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df. It is recommended to apply a patch to fix this issue.", "references": ["https://vuldb.com/vuln/376376", "https://vuldb.com/vuln/376376/cti", "https://vuldb.com/cve/CVE-2026-14787"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14786", "noindex": false, "published": "2026-07-06T01:00:10.542Z", "modified": "2026-07-07T02:55:39.743Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14786", "title": "radareorg radare2 str.c r_str_word_get0set integer overflow", "description": "A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulation results in integer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 11ac224c0eb8d57830fccc99e1c1cd8e5d958813. It is best practice to apply a patch to resolve this issue.", "references": ["https://vuldb.com/vuln/376375", "https://vuldb.com/vuln/376375/cti", "https://vuldb.com/cve/CVE-2026-14786"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14761", "noindex": false, "published": "2026-07-05T15:45:08.421Z", "modified": "2026-07-06T18:46:20.994Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14761", "title": "radareorg radare2 str.c r_str_append integer overflow", "description": "A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.", "references": ["https://vuldb.com/vuln/376350", "https://vuldb.com/vuln/376350/cti", "https://vuldb.com/cve/CVE-2026-14761"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14760", "noindex": false, "published": "2026-07-05T15:30:08.954Z", "modified": "2026-07-06T15:40:58.650Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14760", "title": "radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free", "description": "A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patch to correct this issue.", "references": ["https://vuldb.com/vuln/376349", "https://vuldb.com/vuln/376349/cti", "https://vuldb.com/cve/CVE-2026-14760"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14759", "noindex": false, "published": "2026-07-05T15:15:08.985Z", "modified": "2026-07-06T13:20:53.970Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00222, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14759", "title": "radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow", "description": "A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.", "references": ["https://vuldb.com/vuln/376348", "https://vuldb.com/vuln/376348/cti", "https://vuldb.com/cve/CVE-2026-14759"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14758", "noindex": false, "published": "2026-07-05T15:00:09.747Z", "modified": "2026-07-06T13:08:17.966Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14758", "title": "radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow", "description": "A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue.", "references": ["https://vuldb.com/vuln/376347", "https://vuldb.com/vuln/376347/cti", "https://vuldb.com/cve/CVE-2026-14758"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-14757", "noindex": false, "published": "2026-07-05T14:45:07.662Z", "modified": "2026-07-06T16:49:53.452Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00208, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14757", "title": "radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow", "description": "A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.", "references": ["https://vuldb.com/vuln/376346", "https://vuldb.com/vuln/376346/cti", "https://vuldb.com/cve/CVE-2026-14757"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-8696", "noindex": false, "published": "2026-05-15T20:52:32.575Z", "modified": "2026-07-14T22:04:01.053Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00603, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8696", "title": "radare2 6.1.5 Use-After-Free via gdbr_pids_list()", "description": "radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. Attackers can trigger the vulnerability by causing qsThreadInfo to fail after qfThreadInfo successfully allocates RDebugPid structures, resulting in double-free memory corruption when the error path attempts to clean up the list.", "references": ["https://github.com/radareorg/radare2/issues/25836", "https://github.com/radareorg/radare2/commit/c213ad6894a1eb9086ac8bf5fae35757e9e1683c", "https://www.vulncheck.com/advisories/radare2-use-after-free-via-gdbr-pids-list"], "fixes": [], "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}]}], "total": 135, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "radare2", "path": "vulns/ubuntu-26.10/radare2", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-22T02:34:10.802Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}