CVE-2026-14788
Description
A flaw was found in radare2. A local attacker could trigger a use-after-free vulnerability within the r_core_bin_load function. This issue can lead to memory corruption, resulting in a denial of service (DoS) for the application.
Statement
This Low impact flaw in radare2, a reverse engineering framework, allows a local attacker to cause a denial of service. The use-after-free vulnerability in the r_core_bin_load function requires local access and specific interaction with the tool, limiting its broader system impact on typical Red Hat deployments.
Mitigation
To mitigate this issue, ensure that only trusted users have local access to systems where the `radare2` package is installed. If `radare2` is not required, consider removing the package to eliminate the potential for exploitation.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
