EUVD-2026-23534
GHSA-4pc8-6qgf-fgv2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
AnalysisAI
Command injection in radare2's DWARF parsing (afsv/afsvj commands) allows local attackers to execute arbitrary shell commands by embedding malicious r2 command sequences in specially crafted ELF binaries. When a user opens the malicious binary and runs analysis commands (aaa followed by afsvj), unsanitized DW_TAG_formal_parameter names are interpolated into pfq command strings, triggering code execution. Fixed in commit bc5a890. EPSS data not available, not in CISA KEV. Publicly disclosed with patch and technical details from VulnCheck.
Technical ContextAI
Radare2 is an open-source reverse engineering framework for binary analysis. This vulnerability exploits the DWARF debugging information parser, specifically how radare2 processes DW_TAG_formal_parameter entries (function parameter metadata) in ELF binaries. The afsv/afsvj commands generate function signature views by reading parameter names from DWARF data and interpolating them into pfq (print formatted query) command strings without proper sanitization. The pfq command appears to support shell command expansion, creating a command injection vector. CWE-78 (OS Command Injection) occurs when external data flows into system command execution contexts without validation. The affected component is radare2's DWARF parser in combination with the function signature analysis subsystem.
RemediationAI
Update radare2 to commit bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 or later from the official repository at https://github.com/radareorg/radare2. Users can apply the patch directly from pull request 25821 (https://github.com/radareorg/radare2/pull/25821). If immediate patching is not feasible, implement these compensating controls with trade-offs: (1) Avoid running afsv/afsvj commands on untrusted binaries - limits DWARF-based function signature analysis capabilities but prevents exploitation; (2) Strip DWARF sections from binaries before analysis using 'strip --strip-debug' - removes debugging symbols entirely, significantly reducing reverse engineering effectiveness; (3) Run radare2 in sandboxed environments (containers, VMs) with restricted shell access when analyzing untrusted samples - adds operational overhead but contains potential command execution impact; (4) Disable shell command execution features in radare2 configuration if supported - may break legitimate automation workflows that rely on shell integration. The patch itself sanitizes parameter name strings before interpolation into command contexts. No known side effects from the fix.
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-d
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated critical severity (CVSS 9.8), th
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering fram
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. Rated critical severity (CVSS 9.1), this vulne
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated cri
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. Rated critic
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Rated high severity (CVSS 8.8), this v
Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process ma
In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_ve
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today