CVE-2026-40499: radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()
radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.1.4 - Compensating control
If upgrading is not immediately possible, prevent untrusted users from supplying PDB files to radare2 (avoid running radare2 on attacker-provided PDBs), since the vulnerability is triggered when the idp command processes a malicious PDB file via the PDB parser print_gvars() function.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40499?
CVE-2026-40499 is classified as a high severity vulnerability due to its potential to allow arbitrary command execution.
How do I fix CVE-2026-40499?
To fix CVE-2026-40499, upgrade Radare2 to version 6.1.4 or later.
What software versions are affected by CVE-2026-40499?
CVE-2026-40499 affects all Radare2 versions prior to 6.1.4.
What type of vulnerability is CVE-2026-40499?
CVE-2026-40499 is a command injection vulnerability related to the PDB parser in Radare2.
Can CVE-2026-40499 be exploited remotely?
Yes, CVE-2026-40499 can be exploited remotely if an attacker can provide specially crafted input to the PDB parser.