CVE-2026-40517: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in radareorg radare2
radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.
AI Analysis
Technical Summary
CVE-2026-40517 is an OS command injection vulnerability (CWE-78) in radare2 before version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where attackers can embed newline characters in symbol names within a malicious PDB file. These unsanitized symbol names are interpolated into radare2 commands, specifically the flag rename command, allowing injection of arbitrary radare2 commands. When the idp command is executed against the malicious PDB file, these injected commands run, leading to arbitrary OS command execution via radare2's shell execution operator.
Potential Impact
Successful exploitation allows an attacker with local access to execute arbitrary operating system commands with the privileges of the user running radare2. This can lead to system compromise, data manipulation, or further escalation depending on the environment and user privileges. The vulnerability requires user interaction (running the idp command on a crafted PDB file) and local access, limiting remote exploitation.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Users should upgrade to radare2 version 6.1.4 or later once available, as this version is indicated as the fixed release. Until then, avoid processing untrusted PDB files with radare2, especially using the idp command. Monitor vendor advisories for official fixes or temporary mitigations.
CVE-2026-40517: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in radareorg radare2
Description
radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.
CVSS v4.0
Score 8.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40517 is an OS command injection vulnerability (CWE-78) in radare2 before version 6.1.4. The issue exists in the PDB parser's print_gvars() function, where attackers can embed newline characters in symbol names within a malicious PDB file. These unsanitized symbol names are interpolated into radare2 commands, specifically the flag rename command, allowing injection of arbitrary radare2 commands. When the idp command is executed against the malicious PDB file, these injected commands run, leading to arbitrary OS command execution via radare2's shell execution operator.
Potential Impact
Successful exploitation allows an attacker with local access to execute arbitrary operating system commands with the privileges of the user running radare2. This can lead to system compromise, data manipulation, or further escalation depending on the environment and user privileges. The vulnerability requires user interaction (running the idp command on a crafted PDB file) and local access, limiting remote exploitation.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Users should upgrade to radare2 version 6.1.4 or later once available, as this version is indicated as the fixed release. Until then, avoid processing untrusted PDB files with radare2, especially using the idp command. Monitor vendor advisories for official fixes or temporary mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-13T20:29:02.809Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e9490f19fe3cd2cdf886c1
Added to database: 04/22/2026, 22:17:51 UTC
Last enriched: 07/15/2026, 10:28:27 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 231
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.