PT-2026-33515 · Radare2 · Radare2

Shota Zaizen · Published 2026-04-17 · Updated 2026-04-20 · CVE-2026-40527

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions radare2 versions prior to commit bc5a890

Description An issue exists in the 'afsv/afsvj' command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW TAG formal parameter names. When the software analyzes a binary using the aaa command and subsequently runs afsvj, unsanitized parameter interpolation in the pfq command string allows for arbitrary shell command execution.

Recommendations Update to the version containing commit bc5a890.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40527

Affected Products

Radare2

References · 9

• https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40527 · Security Note
• https://ubuntu.com/security/CVE-2026-40527 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40527 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40527 · Vendor Advisory
• https://github.com/radareorg/radare2/pull/25821 · Note
• https://twitter.com/VulmonFeeds/status/2045265706447471032 · Twitter Post
• https://twitter.com/CVEnew/status/2045467405552337063 · Twitter Post
• https://vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-names · Note