CVE-2026-40517: radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
radare2to a version that resolves this vulnerability.Fixed in 6.1.4 - Compensating control
Do not run radare2 idp against untrusted/malicious PDB files until radare2 is upgraded to 6.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40517?
CVE-2026-40517 is considered a high severity vulnerability due to its capability to allow arbitrary command execution.
How do I fix CVE-2026-40517?
To fix CVE-2026-40517, upgrade radare2 to version 6.1.4 or later.
What versions of radare2 are affected by CVE-2026-40517?
CVE-2026-40517 affects all versions of radare2 prior to 6.1.4.
What kind of attacks can be performed using CVE-2026-40517?
CVE-2026-40517 allows attackers to execute arbitrary commands by crafting malicious PDB files.
Where is the command injection vulnerability found in CVE-2026-40517?
The command injection vulnerability in CVE-2026-40517 is found in the PDB parser's print_gvars() function.