Command Injection in Radare2 PDB Parser Affecting Radare2 Software

CVE-2026-40517

What is CVE-2026-40517?

Radare2 versions prior to 6.1.4 are susceptible to a command injection flaw within the PDB parser’s print_gvars() function. This vulnerability arises when an attacker crafts a malicious PDB file that incorporates newline characters within the symbol names. Through this manipulation, arbitrary commands can be injected into the radare2 environment via unsanitized symbol name interpolation. When a user executes the idp command against a compromised PDB file, the embedded commands are executed, potentially allowing the attacker to execute arbitrary operating system commands through radare2’s shell execution capabilities.

References