The vulnerability in radare2 (CVE-2026-40527) involves improper neutralization of special elements used in OS commands (CWE-78). Specifically, crafted ELF binaries can include malicious shell commands within DWARF DW_TAG_formal_parameter names. When radare2 processes these binaries using the aaa command and then executes afsvj, the embedded commands are interpolated unsafely in the pfq command string, leading to arbitrary shell command execution. This affects radare2 versions prior to the commit bc5a890. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary shell commands on the system running radare2 by embedding malicious commands in ELF binaries. This can lead to unauthorized code execution with the privileges of the user running radare2. The CVSS 4.0 score of 8.5 indicates high severity with local attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, avoid analyzing untrusted ELF binaries with radare2 commands aaa and afsvj. Consider running radare2 in a restricted environment or sandbox to limit potential impact.