CVE-2026-14789: A vulnerability was detected in radareorg radare2 up to 6.1.6

Routine

LOW 3.3UPGRADE

CVE-2026-14789 is a low-severity flaw (CVSS 3.3) affecting radare2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38fb5762. It is suggested to install a patch to addr

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	3.3 (Low)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.2% (top 87%)
CISA exploited list	No
Weakness	CWE-119, CWE-121
Published	2026-07-06
Last modified	2026-10-25

Publisher (CNA): VulDB · Vendor: radare

Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-07-06 03:16 UTCPublished CVE record published
2026-10-25 15:10 UTCUpdated Record last modified

radare radare2 UPGRADE

Affected: >= 6.1.0 and <= 6.1.6

Fixed in: newer than 6.1.6

Safe to downgrade to: a release before 6.1.0

1. Check installed version

apt-cache policy radare2 || rpm -q radare2 || radare2 --version

2. UPGRADE to newer than 6.1.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade radare2

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade radare2

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 6.1.0 (Debian / Ubuntu)

apt-cache madison radare2 sudo apt install radare2=<VERSION_BEFORE_6.1.0> sudo apt-mark hold radare2

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list radare2 sudo dnf downgrade radare2-<VERSION_BEFORE_6.1.0> sudo dnf versionlock add radare2

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-14789?

radare2: upgrade to newer than 6.1.6. Exact commands for each OS are on this page.

Is CVE-2026-14789 being exploited?

CVE-2026-14789 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-14789 affect?

CVE-2026-14789 affects radare2. Severity is low (CVSS 3.3). A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in sta

How urgent is CVE-2026-14789?

Priority 20/100. Public exploit reference

Related CVEs

CVE-2026-14757 MEDIUM 5.3 UPGRADE A vulnerability was determined in radareorg radare2 up to 6.1.6
CVE-2026-14759 LOW 3.3 UPGRADE A security flaw has been discovered in radareorg radare2 up to 6.1.6
CVE-2026-14758 LOW 3.3 UPGRADE A vulnerability was identified in radareorg radare2 up to 6.1.6
CVE-2026-14760 LOW 3.3 UPGRADE A weakness has been identified in radareorg radare2 up to 6.1.6
CVE-2026-14761 LOW 3.3 UPGRADE A security vulnerability has been detected in radareorg radare2 up to 6.1.6

References

← Back to latest CVEs