CVE-2026-40527: radare2 Command Injection via DWARF Parameter Names
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DWTAGformalparameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40527?
CVE-2026-40527 is considered a critical vulnerability due to the potential for command injection.
How do I fix CVE-2026-40527?
To fix CVE-2026-40527, upgrade radare2 to a version after commit bc5a890.
Who is affected by CVE-2026-40527?
CVE-2026-40527 affects users of radare2 versions prior to commit bc5a890.
What type of vulnerability is CVE-2026-40527?
CVE-2026-40527 is a command injection vulnerability embedded within DWARF parameter names.
What can an attacker achieve with CVE-2026-40527?
An attacker exploiting CVE-2026-40527 can execute arbitrary r2 commands through maliciously crafted ELF binaries.