CVE-2026-40527 is an OS command injection vulnerability in radare2 before commit bc5a890. The vulnerability arises from the afsv/afsvj command path where malicious ELF binaries embed shell commands as DWARF DW_TAG_formal_parameter names. When radare2 analyzes such binaries with the aaa command and then executes afsvj, the unsanitized interpolation of these parameters in the pfq command string leads to arbitrary shell command execution. This vulnerability is classified under CWE-78 and has a CVSS 4.0 score of 8.5, indicating high severity. No official patch or remediation guidance is currently documented.

Successful exploitation allows an attacker to execute arbitrary shell commands on the system running radare2 without requiring privileges or user interaction beyond opening a crafted binary. This can lead to full system compromise depending on the environment and permissions of the radare2 process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid analyzing untrusted or suspicious ELF binaries with radare2 commands aaa and afsvj to prevent exploitation.