CVE-2026-40517

Radare Radare2 command injection

7.8 HIGHPublic exploitEPSS 1.72%

Published22 Apr 2026

Description

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Radare Radare2< 6.1.4

Remediation

Fixed in

Radare Radare2≥ 6.1.4

References

https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zeroExploitThird Party Advisory
https://github.com/radareorg/radare2/issues/25730ExploitIssue TrackingThird Party Advisory
https://github.com/radareorg/radare2/pull/25731Issue Tracking
https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-namesThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-40517 being actively exploited?

CVE-2026-40517 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.72%.

How severe is CVE-2026-40517?

CVE-2026-40517 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 1.72% probability of exploitation.

Which products are affected by CVE-2026-40517?

Affected products include Radare Radare2.

How do I fix CVE-2026-40517?

Upgrade affected software to a fixed version, for example Radare Radare2 6.1.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-40517 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.