Bug 2497163 (CVE-2026-14759) - CVE-2026-14759 radare2: radare2: Denial of Service via heap-based buffer overflow
Summary: CVE-2026-14759 radare2: radare2: Denial of Service via heap-based buffer over...
Keywords:
Status: NEW
Alias: CVE-2026-14759
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2497341 2497342
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-05 16:01 UTC by OSIDB Bzimport
Modified: 2026-07-06 13:48 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-05 16:01:30 UTC
A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to deploy a patch.


Note You need to log in before you can comment on or make changes to this bug.