Quick answers
- Is CVE-2026-40527 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40527 being exploited in the wild.
- How severe is CVE-2026-40527?
- High severity, with a CVSS score of 7.8, published 17 April 2026.
- Which products and versions are affected?
- radareorg radare2 prior to commit bc5a890.
- Is there a fix for CVE-2026-40527?
- A patch was published on 2026-04-15: Fix merged in pull request 25821 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40527 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-40527?
- Check whether you run Radare2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability exists in radare2's handling of DWARF debug information within ELF binaries. The root cause is the lack of sanitization of DW_TAG_formal_parameter names, which are stored in the type database and later interpolated into a 'pfq' command string via r_core_cmd_strf. An attacker can craft a binary containing r2 shell operators (like '|!') in the DWARF parameter names. When a user performs analysis (e.g., using 'aaa') and subsequently runs the 'afsv' or 'afsvj' commands, the embedded shell commands are executed with the privileges of the radare2 process. This issue was addressed in commit bc5a890.
Affected products
- radareorg radare2 prior to commit bc5a890
Timeline
- 2026-04-15: patched: Fix merged in pull request 25821
- 2026-04-17: disclosed: CVE published