{"id":"CVE-2026-40517","aliases":["EUVD-2026-25119","GHSA-3xv9-7r7g-8q6f","UBUNTU-CVE-2026-40517","openSUSE-SU-2026:21988-1"],"status":"published","title":"radare2 \u003c 6.1.4 Command Injection via PDB Parser Symbol Names","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01051,"percentile":0.64714,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-04-22T21:44:12Z","modified":"2026-11-09T02:47:15Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-3.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0+dfsg-1","2.0.0+dfsg-1","2.1.0+dfsg-1","2.3.0+dfsg-1","2.3.0+dfsg-2","2.3.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1+dfsg-5build1","4.0.0+dfsg-1","4.2.1+dfsg-1","4.2.1+dfsg-2","4.2.1+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.0+dfsg-1ubuntu1","5.5.0+dfsg-1.1ubuntu2","5.5.0+dfsg-1.1ubuntu3","5.5.0+dfsg-1.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.8+dfsg-2","5.9.8+dfsg-2ubuntu0.25.10.1","5.9.8+dfsg-2ubuntu0.25.10.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.7+ds-1","6.1.6+ds-2","6.1.6+ds-3","6.1.8+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.8+dfsg-2","6.0.4+dfsg-1","6.0.7+ds-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"radare2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.2-bp160.1.1"}]}],"bundled":20}],"products":[{"vendor":"radare","product":"radare2"},{"vendor":"radare2","product":"radare2"},{"vendor":"radareorg","product":"radare2"}],"references":[{"url":"https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero","tags":["technical-description","exploit","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/radareorg/radare2/issues/25730","tags":["issue-tracking","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/radareorg/radare2/pull/25731","tags":["issue-tracking","patch","Issue Tracking","fix"]},{"url":"https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40517","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3xv9-7r7g-8q6f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40517.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40517","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259722","tags":["report"]},{"url":"https://bugzilla.suse.com/1262190","tags":["report"]},{"url":"https://bugzilla.suse.com/1262336","tags":["report"]},{"url":"https://bugzilla.suse.com/1262680","tags":["report"]},{"url":"https://bugzilla.suse.com/1265403","tags":["report"]},{"url":"https://bugzilla.suse.com/1270445","tags":["report"]},{"url":"https://bugzilla.suse.com/1270447","tags":["report"]},{"url":"https://bugzilla.suse.com/1270449","tags":["report"]},{"url":"https://bugzilla.suse.com/1270450","tags":["report"]},{"url":"https://bugzilla.suse.com/1270452","tags":["report"]},{"url":"https://bugzilla.suse.com/1270453","tags":["report"]},{"url":"https://bugzilla.suse.com/1282338","tags":["report"]},{"url":"https://bugzilla.suse.com/1282339","tags":["report"]},{"url":"https://bugzilla.suse.com/1282340","tags":["report"]},{"url":"https://bugzilla.suse.com/1282341","tags":["report"]},{"url":"https://bugzilla.suse.com/1282342","tags":["report"]},{"url":"https://bugzilla.suse.com/1282343","tags":["report"]},{"url":"https://bugzilla.suse.com/1282344","tags":["report"]},{"url":"https://bugzilla.suse.com/1282345","tags":["report"]},{"url":"https://bugzilla.suse.com/1282346","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8695","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-40517","title":"radare2 \u003c 6.1.4 Command Injection via PDB Parser Symbol Names","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-22T21:44:12.543Z","modified":"2026-11-08T14:02:55.682Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-25119","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-22T21:44:12Z","modified":"2026-11-08T14:02:55Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:09.268962Z"}],"ghsa":[{"id":"GHSA-3xv9-7r7g-8q6f","title":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars...","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-23T00:31:17Z","modified":"2026-04-23T00:31:26Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:07:35.737909Z"}],"nvd":[{"id":"CVE-2026-40517","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-22T22:16:31.183Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-40517","title":"radare2 \u003c 6.1.4 Command Injection via PDB Parser Symbol Names","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-22T21:44:12.543Z","modified":"2026-11-09T02:47:15.072567359Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-09T03:16:24.800471Z"},{"id":"UBUNTU-CVE-2026-40517","description":"radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.","status":"published","published":"2026-04-22T22:16:00Z","modified":"2026-10-17T12:58:53.941176743Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"openSUSE-SU-2026:21988-1","title":"Security update for radare2","description":"This update for radare2 fixes the following issues:\n\nChanges in radare2:\n\n- Update to version 6.2.2:\n  * Analysis: new JNI plugin with typed interface tables, arm64\n    Swift float calling conventions, DWARF prototype linking,\n    jump-table and switch-case fixes\n  * Core: fix RAnalOp leaks in disasm/diff/debug loops, aoj memory\n    use, partial-read handling, fp variable recovery\n  * Bundle sdb 2.5.2 (upstream pin): rename shlib to libsdb2_5_2\n  * Details can be found here:\n    https://github.com/radareorg/radare2/releases/tag/6.2.2\n\n- Security issues fixed:\n  * CVE-2026-81886: Validate dmp64 page counts against dump size\n    (boo#1282346).\n  * CVE-2026-81885: Fix infinite loop in the NE fixup parser\n    (boo#1282345).\n  * CVE-2026-81884: Validate Mach-O LC_DATA_IN_CODE ranges\n    (boo#1282344).\n  * CVE-2026-81883: Fix Lua function parser OOB reads (boo#1282343).\n  * CVE-2026-81882: Fix bplist Unicode string conversion (boo#1282342).\n  * CVE-2026-81881: Fix Swift Mach-O field metadata bounds check\n    (boo#1282341).\n  * CVE-2026-81880: Decode PEF relocs lazily, add more bounds and\n    overflow checks (boo#1282340).\n  * CVE-2026-81879: Fix oobread in ELF PN_XNUM phdr count handling\n    (boo#1282339).\n  * CVE-2026-81878: Fix heap write overflow in Python loader\n    (boo#1282338).\n  * CVE-2026-14788: Denial of Service via use-after-free in\n    r_core_bin_load function (boo#1270453).\n  * CVE-2026-14761: Denial of service via integer overflow in string\n    manipulation functions (boo#1270452).\n  * CVE-2026-14760: Denial of Service via local use-after-free\n    vulnerability (boo#1270450).\n  * CVE-2026-14759: Denial of Service via heap-based buffer overflow\n    (boo#1270449).\n  * CVE-2026-14758: Denial of Service via integer overflow in hexpairs\n    parser (boo#1270447).\n  * CVE-2026-14757: Integer overflow allows local impact (boo#1270445).\n  * CVE-2026-40527: Command injection vulnerability in the afsv/afsvj\n    (boo#1262336).\n  * CVE-2026-4174: Missing validation against an upper limit when\n    allocating memory in the Mach-O file parser can lead to excessive\n    resource consumption (boo#1259722).\n- Security issue fixed with the previous release:\n  * CVE-2026-41015: Configured on UNIX without SSL, allows command\n    injection via a PDB name to rabin2 (boo#1262190).\n  * CVE-2026-40517: Crafted PDB file with newline characters in symbol\n    names can allow to inject arbitrary commands (boo#1262680).\n  * CVE-2026-8695: UAFs in the gdb remote protocol ##crash (boo#1265403).\n","status":"published","published":"2026-09-25T08:25:52Z","modified":"2026-10-01T18:23:10.943305024Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}