Command Injection in radare2 by radareorg

CVE-2026-40527

What is CVE-2026-40527?

radare2 versions prior to a specific commit contain a command injection vulnerability in the afsv/afsvj command execution path. Attackers can exploit this weakness by crafting ELF binaries that contain malicious r2 command sequences disguised as DWARF DW_TAG_formal_parameter names. When the radare2 tool analyzes such binaries using the 'aaa' command followed by 'afsvj', it inadvertently executes these embedded shell commands. This vulnerability stems from a lack of sanitization, allowing arbitrary shell command execution through insufficiently validated parameter interpolation in the pfq command string.

References