CVE-2026-14761

lowCVSS 3.3covered by 1 sourcefirst seen 2026-07-05

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix this issue.

⚡ Watch CVE-2026-14761

Get an email if CVE-2026-14761 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.

Advisory coverage (1)

lowCVE-2026-14761: A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected elem…nvd · 2026-07-05

External references

NVD record for CVE-2026-14761

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-14761 status](https://www.csirts.com/badge/CVE-2026-14761)](https://www.csirts.com/cve/CVE-2026-14761)