CVE-2026-14788 is a use-after-free vulnerability in radareorg radare2 versions 6.1.0 to 6.1.6. It occurs in the r_core_bin_load function of libr/core/cfile.c, allowing local attackers to manipulate memory after it has been freed. The vulnerability has been publicly disclosed, and a patch is available under commit 635ab1eeb30340c26076722a90cb91fb2272130b. Exploitation requires local privileges and no user interaction is needed. The CVSS 4.0 vector indicates low attack complexity and privileges required, with no impact on confidentiality, integrity, or availability beyond local attack scope.

Successful exploitation of this use-after-free vulnerability could lead to undefined behavior such as application crashes or potential local privilege escalation. However, the CVSS score of 4.8 and vector indicate limited impact confined to local users with low privileges. There is no indication of remote exploitation or impact on confidentiality, integrity, or availability beyond the local system.

A patch addressing this vulnerability is available and identified by commit 635ab1eeb30340c26076722a90cb91fb2272130b. Applying this patch to update radare2 beyond version 6.1.6 is advised to remediate the issue. Since the vulnerability requires local access, restricting local user privileges and access can also reduce risk. Patch status is confirmed by the presence of the patch commit; no official vendor advisory was provided in the input.