CVE-2026-40499
Description
radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | sid | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| radare | radare2 | {"endIncluding":"6.1.4"} | |
References
- https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397
- https://github.com/radareorg/radare2/issues/25752
- https://github.com/radareorg/radare2/releases/tag/6.1.4
- https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-print-gvars
- https://security-tracker.debian.org/tracker/CVE-2026-40499
CWEs
CWE-78
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.