Vulnerability · Published Apr 17, 2026 · Assigned by VulnCheck

CVE-2026-40527radare2 Command Injection via DWARF Parameter Names

High 7.8

In plain English

A high-severity OS command injection in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.9%top 39.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:25.10	radare2	no fix listed	UBUNTU-CVE-2026-40527
Ubuntu:26.04:LTS	radare2	no fix listed	UBUNTU-CVE-2026-40527
Ubuntu:26.10	radare2	no fix listed	UBUNTU-CVE-2026-40527

Affected products (as reported)

Vendor	Product	Versions
radareorg	radare2	0 – before bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/radareorg/radare2/pull/25821 issue-tracking
https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 patch
https://www.vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-names third-party-advisory