Radare2 Command Injection: Malicious PDB Files Execute OS Commands

The National Vulnerability Database has disclosed CVE-2026-40517, a critical command injection vulnerability in radare2 versions prior to 6.1.4. This flaw resides within the PDB parser’s print_gvars() function. Attackers can exploit this by crafting a malicious PDB file that includes newline characters in symbol names.

This manipulation allows for arbitrary radare2 command injection via unsanitized symbol name interpolation in the flag rename command. When a user subsequently runs the idp command against the specially crafted PDB file, these injected commands are executed. Critically, this can escalate to arbitrary operating system command execution through radare2’s built-in shell execution operator. The National Vulnerability Database assigns this a CVSS score of 7.8 (High).

For defenders, this is a stark reminder that even trusted tools can be weaponized. The attack vector relies on user interaction (running idp on a malicious file), making it a social engineering or supply chain risk. Ensure all radare2 installations are updated to version 6.1.4 or later immediately. Educate your teams on the dangers of processing untrusted files, especially those from external or unverified sources.