CVE-2026-40527
highpriority · track · 0EPSS 0.009 · 60 %ileEUUSEPSS · scored 2026-10-27
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://github.com/radareorg/radare2/releasesPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-40527cnnvd
- https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683enisa_euvd
- https://github.com/radareorg/radare2/pull/25821enisa_euvd
- https://www.vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-namesenisa_euvd
- https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683Patchnvd
- https://github.com/radareorg/radare2/pull/25821ExploitIssue TrackingPatchnvd
- https://www.vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-namesThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan