CVE-2026-40499

CVE-2026-40499 is a command injection vulnerability in radare2 versions prior to 6.1.4, located in the PDB parser's print_gvars() function. Attackers can exploit this flaw by crafting malicious PDB files with specially crafted section names containing newline bytes, allowing them to inject and execute arbitrary r2 commands when the idp command processes the file. The vulnerability specifically affects the PE section header name field parsing logic. The attack vector appears to be local or file-based, requiring an attacker to create and deliver a malicious PDB file to a target user. The attack complexity is relatively low, as the vulnerability can be triggered through file parsing without requiring special privileges or user interaction beyond opening the crafted file. Successful exploitation would allow arbitrary command execution within the context of the radare2 application. This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild. The EPSS score of 0.0017 suggests minimal real-world exploitation probability, and the FAUCET risk score of 41/100 indicates moderate concern. Community attention appears limited, and exploit code availability has not been reported, though users of radare2 should still upgrade to version 6.1.4 or later to address this issue.