A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.

A flaw was found in radareorg radare2. A local attacker can perform a manipulation in the RBinJava Line Number Table Parser component, specifically within the `r_bin_java_inner_classes_attr_calc_size` function. This can lead to a heap-based buffer overflow, resulting in a denial of service.

This Low impact flaw in radare2's RBinJava Line Number Table Parser allows a local attacker to trigger a heap-based buffer overflow. By manipulating the `r_bin_java_inner_classes_attr_calc_size` function, an attacker can cause a denial of service. Exploitation requires local access to the system where radare2 is installed. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. https://www.cve.org/CVERecord?id=CVE-2026-14759 https://nvd.nist.gov/vuln/detail/CVE-2026-14759 https://github.com/radareorg/radare2/ https://github.com/radareorg/radare2/commit/cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87 https://github.com/radareorg/radare2/issues/26043 https://vuldb.com/cve/CVE-2026-14759 https://vuldb.com/submit/850383 https://vuldb.com/vuln/376348 https://vuldb.com/vuln/376348/cti