CVE-2026-40527

HIGH 7.8

radare2 Command Injection via DWARF Parameter Names

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.

CWE	CWE-78
Vendor	radareorg
Product	radare2
Published	Apr 17, 2026

Stay Ahead of the Next One

Get instant alerts for radareorg radare2

Be the first to know when new high vulnerabilities affecting radareorg radare2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

radareorg / radare2

0 < bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/radareorg/radare2/pull/25821 github.com: https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 vulncheck.com: https://www.vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-names

Credits

Shota Zaizen