CVE-2026-40517 Details
Description
radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.
A command injection vulnerability has been identified in radare2 versions prior to 6.1.4. The issue arises in the PDB parser's print_gvars() function, where the raw symbol names from PDB files are improperly sanitized before being interpolated into command flags. This allows attackers to execute arbitrary commands by crafting malicious PDB files with newline characters in the symbol names. When the idp command is executed on the affected PDB file, the injected commands are executed, leading to arbitrary operating system command execution via radare2's shell execution operator.
Users can upgrade to radare2 version 6.1.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero | [email protected] | ExploitThird Party Advisory |
| https://github.com/radareorg/radare2/issues/25730 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://github.com/radareorg/radare2/pull/25731 | [email protected] | Issue Tracking |
| https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| radare radare2 | < 6.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |