CVE-2026-40499

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

CVE-2026-40499, Command Injection via PDB Parser print_gvars()

These are all security issues fixed in the libsdb2_4_2-6.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for radare2 fixes the following issues:

Changes in radare2:

• Update to version 6.1.4 (bsc#1262142, CVE-2026-40499):

  • Analysis: improve autoname scoring, jmptbl detection, and performance
  • Add callargs modifier, rnum expressions, and typed function context
  • Refactor autoname into plugin; extend RAnalPlugin hooks
  • Fix leaks, overflows, and command injection in analysis scripts
  • Improve string detection, wide strings, and switch/case analysis
  • Arch: fix v850/nds32 ESIL, optimize to O(1), improve pseudo support
  • Cache capstone options and improve multi-arch disassembly
  • ASM: add camel syntax support, unify via RArch API
  • Bin: major parser fixes (ELF, Mach-O, PE, DEX, PDB, WAD, XCOFF)
  • Fix leaks, OOB reads/writes, overflows, and improve bounds checks
  • Improve Swift demangling, ARM hints, relocations, and imports
  • Add nds32 reloc support and optimize kernelcache parsing
  • Build: install to lib64, fix illumos and packaging issues
  • CI: add GitHub Actions and FilC builds
  • Console: fix multiple overflows, OOB issues, and improve performance
  • Core: API renames, plugin load order, sandbox/config fixes
  • Crash: extensive fixes (UAF, OOB, overflows, injections, fuzz bugs)
  • Harden ELF, PDB, kernelcache, regex, disassemblers, and webserver
  • Debug: improve ptrace, winkd support, breakpoints, checkpoints
  • Disasm: cache flag lookups for performance
  • FS/IO: fix leaks, bounds, sparse IO, and device handling
  • HTTP/socket: webserver fixes and SSL fallback handling
  • Print/projects: improve formatting, endian handling, project metadata
  • Pseudo: add while/switch support and cleaner control flow
  • Search/shell: improve commands, parsing, and usability
  • Security: fix widespread command injection and sandbox escapes
  • Tests/tools: improve r2r, CLI tools, fuzzing, and plugin support
  • Types/util: parsing improvements, JSON/base64 updates, optimizations
  • Visual: fix UAF/leaks, improve panels and UX
  • Full changelog is available at: https://github.com/radareorg/radare2/releases/tag/6.1.4

• Update to version 6.1.2:

  • Analysis: preserve timeouts, improve bb/jmptbl validation and limits
  • Optimize string detection and hot-path functions
  • Add APIs for function signatures, vars limits, and instruction hints
  • Fix overlapped functions, invalid code checks, and large bb handling
  • API: remove deprecated librmagic/filetype APIs and name filter
  • Arch: fix Thumb/endianness issues, add Python pseudo plugin
  • ASM: unify settings via RArch, fix directives, add bf pseudo plugin
  • Bin: improve ELF/Mach-O stripped detection and parsing safety
  • Harden Mach-O bounds, optimize kernelcache and XNU parsing
  • Fix many leaks (DEX, demangler, parsers) and infinite loops
  • Improve DWARF handling and symbol/type extraction
  • Build: improve meson, toolchains, and add ISO/docker support
  • Console: preserve timeout, fix themes and UTF-8 handling
  • Core: fix config bugs, improve startup and addressing support
  • Crash: fix UAF, OOB, race conditions, regex bugs, and overflows
  • Add safety checks across dotnet, Mach-O, DWARF, and webserver
  • Debug/ESIL: safer execution and divide-by-zero handling
  • FS/IO: fix HFS+, dyldcache speedups, safer zip handling
  • Graph: add bb size limit option
  • Print: merge commands, improve UTF-8 and formatting
  • Projects/tools: new configs, plugin support, CLI improvements
  • Search: faster analysis search and block buffering
  • Shell: improve grep/macros and file operations
  • Types: lazy-load, cache, and improve parsing (varargs, structs)
  • Tests: expand fuzzing and test suites
  • General cleanup, performance tuning, and safety improvements
  • Full changelog is available at: https://github.com/radareorg/radare2/releases/tag/6.1.4

• Update to version 6.1.0:

  • Reimplement RBufRef using RRef; fix RLibDelHandler API
  • Remove stale JAY code; improve analysis performance and CI speed
  • Optimize type…