radare2 CVE-2026-6941

Exploitation requires the victim to actively import a malicious .zrp archive using radare2's project import command (Pzi) and then trigger a note operation (Pn). The attack vector is local (AV:L per CVSS 4.0): the crafted .zrp file must already exist on the victim's local filesystem before import, meaning delivery relies on social engineering, supply chain compromise of a shared archive repository, or an existing file-write primitive. User interaction is required (UI:P): the victim must deliberately execute the import command. No non-default configuration is needed - any radare2 session with the project system active and a configured dir.projects path is vulnerable when a symlinked archive is imported. Limiting factors: the attacker has no direct remote code path; files accessible via the symlink are constrained to what the radare2 process user can access on the local system; and the attacker cannot know in advance whether specific target paths exist unless they have prior knowledge of the victim's system layout.

The CVSS 4.0 score of 6.9 with AV:L and UI:P correctly characterizes this as a moderate-severity, socially-engineered local attack. The EPSS score of 0.01% at the 1st percentile reflects near-zero probability of opportunistic automated exploitation, consistent with SSVC's 'Automatable: no' designation - each attack requires a bespoke malicious archive and deliberate victim action. The VI:H integrity impact is the most serious signal: a successful attack can overwrite arbitrary files on the victim's system (limited only by the process owner's filesystem permissions), while VC:L indicates only limited file read capability. The POC is confirmed public via the GitHub PR #25831 test suite, which includes a fully working exploit harness, elevating practical exploitability above what EPSS alone suggests. However, KEV absence means no confirmed in-the-wild abuse. The realistic threat is targeted: reverse engineers and malware analysts routinely share project archives, making this community a plausible social engineering target. CVSS and SSVC signals are internally consistent - no conflicting data identified.

An attacker crafts a .zrp archive containing a notes.txt that is a symbolic link targeting a sensitive file outside the project directory, such as /home/analyst/.ssh/authorized_keys or /etc/passwd, then distributes this archive via a reverse-engineering forum, GitHub repository, or direct message to a security researcher. When the victim imports the archive with the Pzi command and accesses notes with Pn, radare2 follows the symlink and reads or overwrites the target file. A complete working proof-of-concept for this scenario is publicly available in the test suite added by PR #25831, including the exact ln -sf and zip -y commands to construct the malicious archive.