CVE-2026-40527
published 2026-04-17CVE-2026-40527: radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2…
PriorityP348high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.92%
56.1th percentile
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| radare | radare2 | < 6.1.6 | 6.1.6 |
| radareorg | radare2 | < bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 | bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4pc8-6qgf-fgv2: radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicio
ghsa_unreviewed·2026-04-17
CVE-2026-40527 [HIGH] CWE-78 GHSA-4pc8-6qgf-fgv2: radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicio
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
VulDB
radareorg radare2 ELF DW_TAG_formal_parameter os command injection
vuldb·2026-04-17·CVSS 8.5
CVE-2026-40527 [HIGH] radareorg radare2 ELF DW_TAG_formal_parameter os command injection
A vulnerability has been found in radareorg radare2 and classified as critical. Affected is the function DW_TAG_formal_parameter of the component ELF Handler. Performing a manipulation results in os command injection.
This vulnerability is reported as CVE-2026-40527. The attack requires a local approach. No exploit exists.
It is suggested to install a patch to address this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [fedora-all]
bugzilla·2026-04-20·CVSS 8.5
CVE-2026-40527 [HIGH] CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [fedora-all]
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [epel-all]
bugzilla·2026-04-20·CVSS 8.5
CVE-2026-40527 [HIGH] CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [epel-all]
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names
bugzilla·2026-04-17·CVSS 8.5
CVE-2026-40527 [HIGH] CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names
CVE-2026-40527 radare2: radare2: Arbitrary code execution via crafted ELF binaries with DWARF parameter names
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
2026-04-17
Published