CVE-2026-40517

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero	Exploit Third Party Advisory
https://github.com/radareorg/radare2/issues/25730	Exploit Issue Tracking Third Party Advisory
https://github.com/radareorg/radare2/pull/25731	Issue Tracking
https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) radare2 anterior a la versión 6.1.4 contiene una vulnerabilidad de inyección de comandos en la función print_gvars() del analizador PDB que permite a los atacantes ejecutar comandos arbitrarios mediante la creación de un archivo PDB malicioso con caracteres de nueva línea en los nombres de los símbolos. Los atacantes pueden inyectar comandos arbitrarios de radare2 a través de la interpolación no saneada de nombres de símbolos en el comando flag rename, los cuales se ejecutan posteriormente cuando un usuario ejecuta el comando idp contra el archivo PDB malicioso, lo que permite la ejecución arbitraria de comandos del sistema operativo a través del operador de ejecución de shell de radare2.

Information

Published : 2026-04-22 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40517

Mitre link : CVE-2026-40517

CVE.ORG link : CVE-2026-40517

JSON object : View

Products Affected

radare

radare2

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-40517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40517", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T13:51:20.805625Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "radareorg", "product": "radare2", "versions": [{"status": "affected", "version": "0", "lessThan": "6.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-22T22:16:31.183", "references": [{"url": "https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/radareorg/radare2/issues/25730", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/radareorg/radare2/pull/25731", "tags": ["Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator."}, {"lang": "es", "value": "radare2 anterior a la versi\u00f3n 6.1.4 contiene una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n print_gvars() del analizador PDB que permite a los atacantes ejecutar comandos arbitrarios mediante la creaci\u00f3n de un archivo PDB malicioso con caracteres de nueva l\u00ednea en los nombres de los s\u00edmbolos. Los atacantes pueden inyectar comandos arbitrarios de radare2 a trav\u00e9s de la interpolaci\u00f3n no saneada de nombres de s\u00edmbolos en el comando flag rename, los cuales se ejecutan posteriormente cuando un usuario ejecuta el comando idp contra el archivo PDB malicioso, lo que permite la ejecuci\u00f3n arbitraria de comandos del sistema operativo a trav\u00e9s del operador de ejecuci\u00f3n de shell de radare2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEDC34E8-8476-44C6-A73A-D9CF18F12844", "versionEndExcluding": "6.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}