radare2 CVE-2026-14788

Exploitation requires a local user account with at least low-privilege access (confirmed by PR:L in the CVSS 4.0 vector) capable of executing radare2 and invoking the binary loading functionality via r_core_bin_load in libr/core/cfile.c. The trigger condition is the act of loading a crafted binary file for analysis - normal and expected usage of the tool. No special configuration, non-default feature flag, or elevated privilege is required beyond the ability to run radare2 locally. Limiting factors: the attack vector is strictly local (AV:L), ruling out remote exploitation entirely; the impact is constrained to availability of the radare2 process (VA:L) with no confidentiality or integrity impact confirmed; and exploitation in practice requires the analyst to open an attacker-controlled file, introducing a social engineering dependency. radare2 is not typically deployed as a network-exposed service, further constraining the realistic attacker population to those with local system presence.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N places this firmly in the medium tier with a score of 4.8. The attack is strictly local, requiring an authenticated user with low privileges to execute radare2 against a crafted file - this substantially reduces the realistic threat surface compared to network-exploitable vulnerabilities. The E:P modifier confirms a public PoC exists, meaning opportunistic exploitation by anyone with local access is feasible. However, the absence of CISA KEV listing indicates no confirmed mass or targeted exploitation in the wild. EPSS data was not provided in the source intelligence; exploitation probability must therefore be inferred from the local-only vector and PoC availability, suggesting low-to-moderate real-world risk. The primary realistic threat is an analyst opening an attacker-supplied malicious binary, making this a supply-chain-style social engineering concern rather than a remotely exploitable flaw. Impact is limited to crashing the radare2 process - no confidentiality or integrity signals are present in the CVSS data.

An attacker with local system access places a specially crafted binary file on the target system and either directly invokes radare2 to load it, or social-engineers a security analyst into opening the file for reverse engineering. When r_core_bin_load processes the malicious binary, the use-after-free condition is triggered, causing radare2 to crash. A public proof-of-concept demonstrating this crash is available at https://github.com/radareorg/radare2/issues/26049, lowering the skill bar for exploitation to anyone with local access and knowledge of the issue.