Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-17 | 1 | Disclosure1 |
| 2026-04-18 | 1 | Disclosure1 |
| 2026-04-20 | 1 | General1 |
Built a security scanner. Trained it on 1,000 real-world CVE samples. It just detected CVE-2026-40527 a vulnerability I found in radare2. https://t.co/r71LcFcnu2
Post summary
The user reports that their scanner detected CVE‑2026‑40527 in radare2, but provides no further technical or exploit details.
CVE-2026-40527 radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command se… https://www.cve.org/CVERecord?id=CVE-2026-40527
Post summary
The text announces a command injection vulnerability (CVE‑2026‑40527) in radare2’s afsv/afsvj command path, allowing malicious ELF binaries to embed r2 commands, with a link to the CVE record.
CVE-2026-40527 Command Injection in radare2 via Malicious DWARF Parameter Names https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40527
Post summary
A command‑injection vulnerability (CVE‑2026‑40527) in radare2, triggered by malicious DWARF parameter names, is disclosed, but no PoC, exploit, active exploitation, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | radare | radare2 | - | - | - |