CVE-2020-15121highCWE-78

CVE-2020-15121: high-severity vulnerability in radareorg radare2

Command injection in Radare2

Published · Updated

Follow this CVE+ Monitor radare2+ Monitor radare2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 1.6%
In short

Radare2 fails to properly validate PDB file names when downloading debug information, allowing attackers to execute arbitrary shell commands by crafting a malicious PDB server path. This happens when opening a specially crafted executable and running the debug download feature.

Technical detail

Command injection vulnerability in radare2's PDB server path handling (CWE-78) occurs when user-controlled file names from the PDB server are passed unsanitized to shell execution. Exploitation requires the victim to open a malicious executable and execute the idpd command, leading to arbitrary code execution in the context of the radare2 process.

Summary generated and translated by AI from the official description.
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Affected products
radareorg · radare2
Related CVEs — radareorg radare2

In the same product, most dangerous first.

CVE-2026-40499HIGHradare2 < 6.1.4 Command Injection via PDB Parser print_gvars()EPSS 1.2%CVE-2026-40517HIGHradare2 < 6.1.4 Command Injection via PDB Parser Symbol NamesEPSS 1.1%CVE-2026-40527HIGHradare2 Command Injection via DWARF Parameter NamesEPSS 0.9%CVE-2025-1744CRITICALOut-of-bounds Write in radare2EPSS 0.5%CVE-2025-1864CRITICALBuffer Overflow and Potential Code Execution in Radare2EPSS 0.5%CVE-2026-112077MEDIUMradareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanismEPSS 0.3%