CVE-2026-14759
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A heap-based buffer overflow vulnerability was discovered in radare2 up to version 6.1.6 in the r_bin_java_inner_classes_attr_calc_size function of shlr/java/class.c, part of the RBinJava Line Number Table Parser. Local manipulation triggers the overflow, and a public exploit exists.
Risk Assessment
The organization faces risk of local privilege escalation or application crash due to heap buffer overflow. The public exploit increases the likelihood of attacks.
Recommendation
Apply the patch identified as cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87 or upgrade radare2 to a version newer than 6.1.6 immediately.
Original NVD description (English source)
A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.