radare2 CVE-2026-14757

Exploitation requires the attacker to have local system access with at least a standard low-privilege user account (PR:L per CVSS 4.0 vector AV:L/PR:L). The attacker must be able to invoke radare2 directly and supply a specially crafted binary input that causes integer overflow in core_anal_bytes. No special non-default configuration of radare2 is required - the vulnerable code path is reachable during normal binary analysis operations. Exploitation is strictly limited to local vectors; remote exploitation is not possible without prior authenticated access to the host. The impact is further bounded by no scope change (SC:N/SI:N/SA:N), meaning exploitation cannot pivot to affect other co-located systems or processes. The primary limiting factor is the local access prerequisite, which excludes opportunistic remote attackers entirely.

The CVSS 4.0 base score of 1.9 is among the lowest assignable, driven by AV:L (local-only exploitation), PR:L (low-privilege user required), and symmetric low-impact ratings across VC:L/VI:L/VA:L with no subsequent-system impact (SC:N/SI:N/SA:N). There is no CISA KEV listing, confirming no verified active threat-actor exploitation at time of analysis. The E:P supplemental metric confirms a public proof-of-concept exists, which meaningfully lowers the skill barrier for exploitation but does not elevate severity on its own. EPSS data was absent from the input, so probabilistic exploitation forecasting cannot be performed. The gap between the publicly disclosed PoC and no KEV listing suggests this has not been observed as part of active campaigns. For most enterprise environments this is genuinely low priority; relevance increases in shared multi-user reverse engineering workstations, automated binary analysis pipelines processing untrusted third-party files, or CTF hosting infrastructure where multiple users share a system.

A low-privilege user on a shared reverse engineering workstation crafts or obtains a malicious binary file and passes it to radare2 for analysis, triggering the integer overflow in core_anal_bytes during the byte analysis phase. Leveraging the publicly disclosed proof-of-concept, the attacker achieves limited access to process memory contents (information disclosure) or minor data manipulation within the radare2 process, consistent with the VC:L/VI:L impact ratings. No network access or elevated privilege is required to reach this code path.