radare2 CVE-2026-14786

The attacker must have local system access with at minimum a low-privilege user account (PR:L per CVSS 4.0). radare2 must be installed on the target system and executable by the attacker's user context. No special configuration, enabled feature, or non-default setting is required - attack complexity is Low (AC:L) and no specific attack target precondition exists (AT:N). Exploitation is limited by the local-only attack vector (AV:L), meaning remote unauthenticated exploitation is not possible; the attacker cannot reach this function over a network. Impact is further bounded to low availability loss (VA:L) on the radare2 process only - no subsequent-system impact (SC/SI/SA all N), no confidentiality or integrity loss on any system.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores 1.9, signaling genuinely low risk. Attack vector is local-only with no network reachability, low privilege requirement, and impact strictly limited to availability of the radare2 process itself - no confidentiality or integrity impact. The E:P supplemental metric confirms a publicly available exploit (PoC), which elevates concern slightly, but the vulnerability is not in CISA KEV, indicating no confirmed active exploitation in the wild. EPSS data was not supplied; given the local attack surface, niche product footprint, and minimal impact ceiling, real-world prioritization should be low for most environments. This is not a 'high-CVSS-but-low-real-risk' scenario - it is genuinely low risk across all available signals. Defenders should patch during normal maintenance cycles rather than treating this as an emergency.

A local attacker with a standard unprivileged account on a system where radare2 is installed crafts a malformed input designed to trigger integer wraparound in r_str_word_get0set, causing an undersized buffer allocation and subsequent memory corruption that crashes the radare2 process. A public proof-of-concept demonstrating this crash is available via the GitHub issue at https://github.com/radareorg/radare2/issues/26047. Because the attack vector is local and impact is limited to application availability, exploitation is constrained to disrupting ongoing reverse engineering sessions rather than achieving code execution or host compromise.