CVE-2026-40499 describes an OS command injection vulnerability in radare2 before version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where specially crafted PE section header names containing newline bytes enable attackers to inject and execute arbitrary r2 commands. This occurs during processing by the idp command, which executes the injected commands embedded in the malicious PDB file. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and has a CVSS v4.0 score of 8.4, indicating high severity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary commands within the radare2 environment by leveraging crafted PDB files. This can lead to unauthorized command execution, potentially compromising the host system or the environment where radare2 is run. The vulnerability requires user interaction (processing a malicious PDB file) and local access to the radare2 tool. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or malicious PDB files with radare2. Monitor radareorg's official channels for updates regarding patches or workarounds.