The vulnerability CVE-2026-14760 in radareorg radare2 up to version 6.1.6 is a use-after-free condition in the r_core_seek_arch_bits function of libr/core/disasm.c, within the regprofile Handler component. This flaw can be triggered by a local attacker manipulating the affected function, potentially leading to memory corruption. The vulnerability has been publicly disclosed with a patch available identified by commit 8b25c773785d85cb0103410a0905089d286921c2. The CVSS 4.0 vector indicates local attack vector with low complexity and no user interaction required. No evidence of exploitation in the wild has been reported.

Successful exploitation of this use-after-free vulnerability could lead to memory corruption, which may cause application crashes or potentially allow an attacker with local access to execute arbitrary code or escalate privileges. However, the CVSS score of 4.8 and medium severity rating indicate a moderate impact level. No remote exploitation or user interaction is required, but the attacker must have local access to the system.

A patch addressing this vulnerability is available as identified by commit 8b25c773785d85cb0103410a0905089d286921c2. It is strongly recommended to apply this patch or upgrade to a fixed version beyond 6.1.6 to remediate the issue. Since this is not a cloud service, remediation depends on the user applying the patch. No vendor advisory was provided to confirm patch status, so verify with the official radareorg repository or vendor channels for the latest remediation guidance.