CVE-2026-40517
Command Injection in radare2 PDB Parser Enables Arbitrary Execution
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| radare | radare2 | to 6.1.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in radare2 versions prior to 6.1.4 within the PDB parser's print_gvars() function. It allows attackers to execute arbitrary commands by crafting a malicious PDB file containing newline characters in symbol names. These specially crafted symbol names are unsanitized and interpolated into the flag rename command, enabling attackers to inject arbitrary radare2 commands. When a user runs the idp command on the malicious PDB file, these injected commands are executed, leading to arbitrary operating system command execution through radare2's shell execution operator.
How can this vulnerability impact me? :
The impact of this vulnerability is significant as it allows an attacker to execute arbitrary operating system commands on the affected system with the privileges of the user running radare2. This can lead to unauthorized access, data manipulation, system compromise, or further exploitation depending on the environment and user privileges.