CVE-2026-40527 | radareorg radare2 ELF DW_TAG_formal_parameter os command injection

A vulnerability has been found in radareorg radare2 and classified as critical. Affected is the function DW_TAG_formal_parameter of the component ELF Handler. Performing a manipulation results in os command injection.

This vulnerability is reported as CVE-2026-40527. The attack requires a local approach. No exploit exists.

It is suggested to install a patch to address this issue.