Vulnerability · Published Apr 15, 2026 · Assigned by VulnCheck

CVE-2026-40499radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()

High 8.4

In plain English

A high-severity OS command injection in radare2 from radareorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)1.2%top 32.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:25.10	radare2	no fix listed	UBUNTU-CVE-2026-40499
Ubuntu:26.04:LTS	radare2	no fix listed	UBUNTU-CVE-2026-40499
Ubuntu:26.10	radare2	no fix listed	UBUNTU-CVE-2026-40499

Affected products (as reported)

Vendor	Product	Versions
radareorg	radare2	0 – before 6.1.4

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/radareorg/radare2/issues/25752 issue-tracking
https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397 patch
https://github.com/radareorg/radare2/releases/tag/6.1.4 release-notes
https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-print-gvars third-party-advisory