Executive brief
radare2 is a popular open-source framework for reverse engineering and analyzing binary files. A vulnerability exists where a specially crafted binary file can trick the software into executing unauthorized system commands when the file is opened and analyzed. This could allow an attacker to take control of a researcher's computer or steal sensitive data if they are persuaded to analyze a malicious file.
Technical details
A command injection vulnerability exists in radare2's handling of DWARF debug information within ELF binaries. The root cause is the lack of sanitization of DW_TAG_formal_parameter names, which are stored in the type database and later interpolated into a 'pfq' command string via r_core_cmd_strf. An attacker can craft a binary containing r2 shell operators (like '|!') in the DWARF parameter names. When a user performs analysis (e.g., using 'aaa') and subsequently runs the 'afsv' or 'afsvj' commands, the embedded shell commands are executed with the privileges of the radare2 process. This issue was addressed in commit bc5a890.
Affected products
- radareorg radare2 prior to commit bc5a890
Timeline
- 2026-04-15: patched: Fix merged in pull request 25821
- 2026-04-17: disclosed: CVE published