https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:22:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336782 EUVD-2026-336782 https://cve.radiocsirt.org/vuln/euvd-2026-336782 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40527 <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40527 https://cve.radiocsirt.org/vuln/ghsa-4pc8-6qgf-fgv2 <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> https://cve.radiocsirt.org/vuln/ghsa-4pc8-6qgf-fgv2 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21988-1 <p>Security update for radare2</p> <p>Security update for radare2</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21988-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40527 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: radare2, Ubuntu:Pro:18.04:LTS: radare2, Ubuntu:Pro:20.04:LTS: radare2, Ubuntu:Pro:24.04:LTS: radare2, Ubuntu:25.10: radare2, Ubuntu:26.04:LTS: radare2</p> <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: radare2, Ubuntu:Pro:18.04:LTS: radare2, Ubuntu:Pro:20.04:LTS: radare2, Ubuntu:Pro:24.04:LTS: radare2, Ubuntu:25.10: radare2, Ubuntu:26.04:LTS: radare2</p> <p>radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40527