Vulnerability · Published Apr 16, 2026 · Assigned by mitre
CVE-2026-41015
High 7.4
In plain English
A high-severity OS command injection in radare2 from radare. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:25.10 | radare2 | no fix listed | UBUNTU-CVE-2026-41015 |
| Ubuntu:26.04:LTS | radare2 | no fix listed | UBUNTU-CVE-2026-41015 |
| Ubuntu:26.10 | radare2 | no fix listed | UBUNTU-CVE-2026-41015 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H