{"id":"CVE-2026-40499","summary":"radare2 \u003c 6.1.4 Command Injection via PDB Parser print_gvars()","details":"radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.","modified":"2026-08-12T16:25:08.414917Z","published":"2026-04-15T02:05:20.899Z","related":["openSUSE-SU-2026:10555-1","openSUSE-SU-2026:20653-1"],"database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40499.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40499.json"},{"type":"ADVISORY","url":"https://github.com/radareorg/radare2/releases/tag/6.1.4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40499"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-print-gvars"},{"type":"REPORT","url":"https://github.com/radareorg/radare2/issues/25752"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"5590c87deeb7eb2a106fd7aab9ca88bfeebb7397"},{"fixed":"4661541e40947fbc269b0c2686d1cd52ad69c1dc"}],"database_specific":{"cpe":"cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.1.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["6.1.2","6.1.0","6.0.8","6.0.7","6.0.6","6.0.4","6.0.2","6.0.0","5.9.8","5.9.6","5.9.4","5.9.2","5.9.0","5.8.8","5.8.6","5.8.4","5.8.2","5.8.0","5.7.8","5.7.6","5.7.4","5.7.2","5.7.0","wip","5.6.8","5.6.6","5.6.4","5.6.2","5.6.0","5.5.4","5.5.2","5.5.0","5.4.2","5.4.0","5.4.0-git","5.3.1","5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40499.json","vanir_signatures_modified":"2026-08-12T16:25:08Z","vanir_signatures":[{"source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"pdb7_parse"},"deprecated":false,"digest":{"function_hash":"177111092852649789713895587575360039548","length":2737},"id":"CVE-2026-40499-010a0575","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"r_bin_pdb_parser_with_buf"},"deprecated":false,"digest":{"function_hash":"208734396509096181641617100949092168705","length":1115},"id":"CVE-2026-40499-12ccb3cb","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"20523645347868433195057193102367280134","length":2604},"id":"CVE-2026-40499-5cea1631","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"init_pdb7_root_stream"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"237663017730909794342154198737137864000","length":501},"id":"CVE-2026-40499-60e829da","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"add_index"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"find_indx_in_list"},"deprecated":false,"digest":{"function_hash":"237001984368721777862308587946042248871","length":215},"id":"CVE-2026-40499-645f0cc5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"function":"parse_pdb_info_stream","file":"libr/bin/format/pdb/pdb.c"},"deprecated":false,"digest":{"function_hash":"275893430698209095598552964498262978854","length":701},"id":"CVE-2026-40499-6dc8cc46"},{"digest":{"line_hashes":["175898049490659133748637405641537256833","115208828744546285178321780707177008711","36668128863630618623941809160694297191","44818784873565092536438807606220939078","169601559145586072656047490800218379992","66991950364143685315837462756636600774","210022447133495313747275339589979937119","161766783038476989952029534461037928370","266641299060648496753643581581184546909","28266694516808422188606473941592405962","79786761847337506091953644849424953055","20259309552848068067947530354255714258","281989391521444440282864408286943080820","309367503855047525447049415322937112554","279498601308930712160673855877327768907","236420517013550076732277144764865665732","42957366648899529263855483835727237579","257063927482879463494360117528550022917","161991965916516562402516570462278568185","212100311910577490584409139721554870919","55113222863499896117752562049974787549","339688410665254638518254081739089795333","52481051353393037951050448664357899330","284945951664332166147647029044874411347","76458386456091858158203397665346243809","167249728742970141903762609084102084999","155826726032589693221731443035382347145","292308545408226761478990392183805635811","138447863100869290057437082915195241356","313064670867452903045984376898115290330","242702117336729681167192154210711374259","65477806951484741994722013575281861039","112695455269183073921184562803531020304","291071914118519169643304303775974824748","167110038724040176242580403477045609194","117202382059500288940367128218053081786","67314992838591118652498177850733509453","219987773449194811670452105345288539312","92649969570085649773971633240626199365","255714989701119944105687507549429818848","10650016781528314719339599527266690019","241313926516192440987145263378894089101","86163408354862756407130408998398783248","306442709509218893299001201124736782778","335135782375098463966923100686483989151","176004598780069095829886871854589384512","294991496474586198371270044076045553701","292772633978929363499891316970965645464","202398189707494595934715248404043048468","2742873722086958339694985466677184673","321734425068280885328047529596475210744","281447951507830599273787070628665442996","20340220624879030301541205104609286746","259766118331572532824036133726659893237","32638194510484806845914115599545822156","125315663469976922414339691861857714893","267620536430986839321320530685321183711","3558743400655241474970618390396250440","13985294360043177457395152427189289053","231239725880355764730333121496922204369","62137002737318067633948363087944515553","118233555809448237833140799772399244733","168129056977411341075683148996469208687","269617970261054679324349363205277555231","283565960641474145005452446450328147994","54239249729659423122983953763157047416","118230071590835672537982223508042908797","225226956424602422846928850373130016502","321108300946371346123914558550743765050","166918759779798227314697570442728320660","17696865754241300000004067410884057582","136415665770255428896849830272684600942","222739014573864691440311552681314311774","209268048188699536618449653037945607880","251288372244924260068541569100007842481","11640418413395889669099373556093230935","127391207569702099554456211454145566021","261633415841361605262496800621782371472","307829985719750682963027072648195678109","247879820410467385904524768859405297092","295560363868717791696629233035746062898","119889459556205721165270443705349314682","97755843630647953659464317211803023998","181686976082450845397271841405534844549","223534692034243109476708564932250502306","68650196338243518180908804808283012801","327523356481434560252215974873689506575","48573997529641989999530168191549422286","88891395764668364473167392921525817069","120513611532756173053838185548254206761","72998754847965587694263386113083910715","298497279189081340743132873091674258759","264626962712952487376127075491142638974","321072792611893077544826536543463454895","36697290766557222939682483929706408167","207222851908699883837543582580357578920","322709003345865385994442806841858235211","178824563271379860879523105986193543765","125591771878360188617528386133683923582","36052295691002874668796350286549468738","265391236791700317698881805552938467188","48088355858879376130875046113241204962","70422202133329857351032854662823941060","88040768887359488920684063662636263144","261181128275942906989041469058007366130","273692825390960723784590646033102080069","78881389671085679993268463799520745211","20130397915617735466555546203535780614","216911670466023796988816705829835011891","288132418411806145782358814540256580822","113305592080762206442088701198667253556","58205792533074696926435022106754051123","261261749161712135754035223797938291234","86884672537363509766585677969069095060","251126798650624693097678787510255457357","150576646346524657179740325889937764596","325107869011606585852672325228779076300","330968840711807808693548311305589674000","253913046909519922021951469730360547772","195601001301800142634805635081921028013"],"threshold":0.9},"id":"CVE-2026-40499-a417239e","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"94284623344387221029745170446616616816","length":2420},"id":"CVE-2026-40499-a470b64a","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"print_gvars"}},{"digest":{"function_hash":"30861160681323452594609331287348141350","length":1641},"id":"CVE-2026-40499-d6ec6c34","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397","target":{"file":"libr/bin/format/pdb/pdb.c","function":"pdb_read_root"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}