CVE-2026-40517 is an OS command injection vulnerability in radare2 prior to version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where unsanitized symbol names containing newline characters allow injection of arbitrary radare2 commands. These commands are interpolated into the flag rename command and executed when the idp command is run against the malicious PDB file. This leads to arbitrary OS command execution through radare2's shell execution operator. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity. No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the system running radare2 by supplying a crafted PDB file. This can lead to full compromise of the affected system depending on the privileges of the radare2 process. The vulnerability requires user interaction (running the idp command) and local access to the malicious file. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or suspicious PDB files with radare2, especially running the idp command on such files. Monitoring vendor channels for updates or patches is recommended.