CVE-2026-41015

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/radareorg/radare2/blob/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2/SECURITY.md?plain=1#L3-L5
https://github.com/radareorg/radare2/commit/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2
https://github.com/radareorg/radare2/issues/25650
https://github.com/radareorg/radare2/pull/25651
https://github.com/radareorg/radare2/issues/25650

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) radare2 antes de 9236f44, cuando se configura en UNIX sin SSL, permite la inyección de comandos a través de un nombre PDB a rabin2 -PP. NOTA: aunque se supone que los usuarios deben usar la última versión de git (no una versión publicada), el rango de fechas para el código vulnerable fue de menos de una semana, ocurriendo después de 6.1.2 pero antes de 6.1.3.

Information

Published : 2026-04-16 03:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41015

Mitre link : CVE-2026-41015

CVE.ORG link : CVE-2026-41015

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-41015", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41015", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T13:15:20.609734Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "radare", "product": "radare2", "versions": [{"status": "affected", "version": "01ca2f61fa43bd3f4b732447de31b16039d820c0", "lessThan": "9236f44a28812fe911814e1b3a7bcf1e4de5d3c2", "versionType": "git"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-16T03:16:27.440", "references": [{"url": "https://github.com/radareorg/radare2/blob/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2/SECURITY.md?plain=1#L3-L5", "source": "cve@mitre.org"}, {"url": "https://github.com/radareorg/radare2/commit/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2", "source": "cve@mitre.org"}, {"url": "https://github.com/radareorg/radare2/issues/25650", "source": "cve@mitre.org"}, {"url": "https://github.com/radareorg/radare2/pull/25651", "source": "cve@mitre.org"}, {"url": "https://github.com/radareorg/radare2/issues/25650", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3."}, {"lang": "es", "value": "radare2 antes de 9236f44, cuando se configura en UNIX sin SSL, permite la inyecci\u00f3n de comandos a trav\u00e9s de un nombre PDB a rabin2 -PP. NOTA: aunque se supone que los usuarios deben usar la \u00faltima versi\u00f3n de git (no una versi\u00f3n publicada), el rango de fechas para el c\u00f3digo vulnerable fue de menos de una semana, ocurriendo despu\u00e9s de 6.1.2 pero antes de 6.1.3."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "cve@mitre.org"}