CVE-2026-14759

Low

Description

A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.

SeverityLow

CVSS3.3

Exploit probability—

ProductRadare2

PublishedJul 5, 2026

First seenJul 5, 2026

Weakness typeCWE-122CWE-122 CWE-119Memory buffer bounds error

How to fix

Update

radare radare26.1.8 or later

Patches

github.com/radareorg/radare2/commit/cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87

Affected products

Product	Affected versions	Fixed in
radare radare2	6.1.0 ≤ v < 6.1.8	6.1.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.