Command Injection Vulnerability in radare2 PDB Parser

CVE-2026-40499

What is CVE-2026-40499?

radare2, prior to version 6.1.4, is susceptible to a command injection vulnerability located in the PDB parser's print_gvars() function. This vulnerability allows attackers to execute arbitrary commands by inserting a newline byte into the PE section header name field of a maliciously crafted PDB file. An attacker could exploit this flaw by embedding specially crafted section names, which would execute unauthorized r2 commands during the processing of the file using the idp command.

References