CVE-2026-40499 is an OS command injection vulnerability in radare2 before version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where newline bytes embedded in the PE section header name field can be used to inject and execute arbitrary commands. Attackers can craft malicious PDB files with specially crafted section names that trigger command execution when processed by the idp command in radare2. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows an attacker to execute arbitrary OS commands on the system running radare2, potentially leading to system compromise or unauthorized actions. The vulnerability requires user interaction (processing a malicious PDB file) and local access (AV:L) but has high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and remediationLevel is null, users should monitor radareorg advisories for updates. Until a patch is available, avoid processing untrusted or suspicious PDB files with radare2, especially using the idp command.