Command Injection Vulnerability in radare2 by radareorg

CVE-2026-41015

What is CVE-2026-41015?

The radare2 binary analysis tool, when configured on UNIX systems without SSL, is susceptible to a command injection vulnerability. This issue arises when a specially crafted PDB name is passed to the rabin2 utility with the -PP flag. The vulnerability specifically affects versions prior to 6.1.3, with the vulnerable code present in a small time window between version 6.1.2 and 6.1.3. Users are advised to utilize the latest version from the Git repository to mitigate potential risks.

References