PT-2026-34573 · Radare2 · Radare2

Jun Rong · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-40517

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.1.4

Description A command injection issue exists in the PDB parser's print gvars() function. An attacker can execute arbitrary OS commands by crafting a malicious PDB file containing newline characters in symbol names. This occurs due to unsanitized symbol name interpolation in the flag rename command, which triggers the execution of injected radare2 commands when a user runs the idp command against the malicious file via radare2's shell execution operator.

Recommendations Update to version 6.1.4 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40517

Affected Products

Radare2

References · 9

• 🔥 https://github.com/radareorg/radare2/issues/25730 · Exploit
• 🔥 https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero · Exploit
• https://github.com/radareorg/radare2/pull/25731 · Patch
• https://ubuntu.com/security/CVE-2026-40517 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40517 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40517 · Security Note
• https://vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names · Note
• https://twitter.com/CVEnew/status/2047359930336748030 · Twitter Post