CVE-2026-40499 is an OS command injection vulnerability in radare2 before version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where newline bytes embedded in the PE section header name field are not properly neutralized. This allows attackers to craft malicious PDB files with specially crafted section names that inject r2 commands. These commands are executed when the idp command processes the file, enabling arbitrary command execution within the context of the radare2 process.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the system running radare2 by supplying a malicious PDB file. This can lead to unauthorized actions and potential system compromise. The CVSS 4.0 score of 8.4 indicates a high severity impact with local attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the radareorg project for updates and apply version 6.1.4 or later once available. Until a fix is released, avoid processing untrusted or suspicious PDB files with radare2 to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.