CVE-2026-14759
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
A security flaw in radare2 up to version 6.1.6 affects the function r_bin_java_inner_classes_attr_calc_size in shlr/java/class.c, part of the RBinJava Line Number Table Parser. Manipulation leads to a heap-based buffer overflow. The attack requires local access and the exploit has been made public.
Risk Assessment
The organization is at risk of local system compromise or application crash due to a heap buffer overflow. The public exploit increases the likelihood of attacks by local users.
Recommendation
Apply the patch identified as cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87 immediately. Upgrade radare2 to a version newer than 6.1.6.
Original NVD description (English source)
A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.