CVE-2026-40499

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40499
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40499.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40499
Downstream
Related
Published
2026-04-15T02:05:20.899Z
Modified
2026-08-12T16:25:08.414917Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()
Details

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40499.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/radareorg/radare2

Affected ranges

Type
GIT
Repo
https://github.com/radareorg/radare2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5590c87deeb7eb2a106fd7aab9ca88bfeebb7397
Fixed
4661541e40947fbc269b0c2686d1cd52ad69c1dc
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.1.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.4-termux4
0.10.5
0.10.6
0.8.6
0.8.8
0.9
0.9.2
0.9.4
0.9.6
0.9.7
0.9.8
0.9.8-rc1
0.9.8-rc2
0.9.8-rc3
0.9.8-rc4
0.9.9
1.*
1.0
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.0-git
1.3.0
1.3.0-git
1.4.0
1.5.0
1.6.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.4.0
2.5.0
2.6.0
2.6.9
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.3.1
4.4.0
4.5.1
5.*
5.0.0
5.1.0
5.1.1
5.2.0
5.2.1
5.3.0
5.3.1
5.4.0
5.4.0-git
5.4.2
5.5.0
5.5.2
5.5.4
5.6.0
5.6.2
5.6.4
5.6.6
5.6.8
5.7.0
5.7.2
5.7.4
5.7.6
5.7.8
5.8.0
5.8.2
5.8.4
5.8.6
5.8.8
5.9.0
5.9.2
5.9.4
5.9.6
5.9.8
6.*
6.0.0
6.0.2
6.0.4
6.0.6
6.0.7
6.0.8
6.1.0
6.1.2
Other
Continuous-Windows
continuous
radare2-windows-nightly
termux
wip
release-5.*
release-5.0.0

Database specific

vanir_signatures 
[
    {
        "target": {
            "function": "pdb7_parse",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-010a0575",
        "signature_type": "Function",
        "digest": {
            "function_hash": "177111092852649789713895587575360039548",
            "length": 2737.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "r_bin_pdb_parser_with_buf",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-12ccb3cb",
        "signature_type": "Function",
        "digest": {
            "function_hash": "208734396509096181641617100949092168705",
            "length": 1115.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "init_pdb7_root_stream",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-5cea1631",
        "signature_type": "Function",
        "digest": {
            "function_hash": "20523645347868433195057193102367280134",
            "length": 2604.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "add_index",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-60e829da",
        "signature_type": "Function",
        "digest": {
            "function_hash": "237663017730909794342154198737137864000",
            "length": 501.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "find_indx_in_list",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-645f0cc5",
        "signature_type": "Function",
        "digest": {
            "function_hash": "237001984368721777862308587946042248871",
            "length": 215.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "parse_pdb_info_stream",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-6dc8cc46",
        "signature_type": "Function",
        "digest": {
            "function_hash": "275893430698209095598552964498262978854",
            "length": 701.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-a417239e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "175898049490659133748637405641537256833",
                "115208828744546285178321780707177008711",
                "36668128863630618623941809160694297191",
                "44818784873565092536438807606220939078",
                "169601559145586072656047490800218379992",
                "66991950364143685315837462756636600774",
                "210022447133495313747275339589979937119",
                "161766783038476989952029534461037928370",
                "266641299060648496753643581581184546909",
                "28266694516808422188606473941592405962",
                "79786761847337506091953644849424953055",
                "20259309552848068067947530354255714258",
                "281989391521444440282864408286943080820",
                "309367503855047525447049415322937112554",
                "279498601308930712160673855877327768907",
                "236420517013550076732277144764865665732",
                "42957366648899529263855483835727237579",
                "257063927482879463494360117528550022917",
                "161991965916516562402516570462278568185",
                "212100311910577490584409139721554870919",
                "55113222863499896117752562049974787549",
                "339688410665254638518254081739089795333",
                "52481051353393037951050448664357899330",
                "284945951664332166147647029044874411347",
                "76458386456091858158203397665346243809",
                "167249728742970141903762609084102084999",
                "155826726032589693221731443035382347145",
                "292308545408226761478990392183805635811",
                "138447863100869290057437082915195241356",
                "313064670867452903045984376898115290330",
                "242702117336729681167192154210711374259",
                "65477806951484741994722013575281861039",
                "112695455269183073921184562803531020304",
                "291071914118519169643304303775974824748",
                "167110038724040176242580403477045609194",
                "117202382059500288940367128218053081786",
                "67314992838591118652498177850733509453",
                "219987773449194811670452105345288539312",
                "92649969570085649773971633240626199365",
                "255714989701119944105687507549429818848",
                "10650016781528314719339599527266690019",
                "241313926516192440987145263378894089101",
                "86163408354862756407130408998398783248",
                "306442709509218893299001201124736782778",
                "335135782375098463966923100686483989151",
                "176004598780069095829886871854589384512",
                "294991496474586198371270044076045553701",
                "292772633978929363499891316970965645464",
                "202398189707494595934715248404043048468",
                "2742873722086958339694985466677184673",
                "321734425068280885328047529596475210744",
                "281447951507830599273787070628665442996",
                "20340220624879030301541205104609286746",
                "259766118331572532824036133726659893237",
                "32638194510484806845914115599545822156",
                "125315663469976922414339691861857714893",
                "267620536430986839321320530685321183711",
                "3558743400655241474970618390396250440",
                "13985294360043177457395152427189289053",
                "231239725880355764730333121496922204369",
                "62137002737318067633948363087944515553",
                "118233555809448237833140799772399244733",
                "168129056977411341075683148996469208687",
                "269617970261054679324349363205277555231",
                "283565960641474145005452446450328147994",
                "54239249729659423122983953763157047416",
                "118230071590835672537982223508042908797",
                "225226956424602422846928850373130016502",
                "321108300946371346123914558550743765050",
                "166918759779798227314697570442728320660",
                "17696865754241300000004067410884057582",
                "136415665770255428896849830272684600942",
                "222739014573864691440311552681314311774",
                "209268048188699536618449653037945607880",
                "251288372244924260068541569100007842481",
                "11640418413395889669099373556093230935",
                "127391207569702099554456211454145566021",
                "261633415841361605262496800621782371472",
                "307829985719750682963027072648195678109",
                "247879820410467385904524768859405297092",
                "295560363868717791696629233035746062898",
                "119889459556205721165270443705349314682",
                "97755843630647953659464317211803023998",
                "181686976082450845397271841405534844549",
                "223534692034243109476708564932250502306",
                "68650196338243518180908804808283012801",
                "327523356481434560252215974873689506575",
                "48573997529641989999530168191549422286",
                "88891395764668364473167392921525817069",
                "120513611532756173053838185548254206761",
                "72998754847965587694263386113083910715",
                "298497279189081340743132873091674258759",
                "264626962712952487376127075491142638974",
                "321072792611893077544826536543463454895",
                "36697290766557222939682483929706408167",
                "207222851908699883837543582580357578920",
                "322709003345865385994442806841858235211",
                "178824563271379860879523105986193543765",
                "125591771878360188617528386133683923582",
                "36052295691002874668796350286549468738",
                "265391236791700317698881805552938467188",
                "48088355858879376130875046113241204962",
                "70422202133329857351032854662823941060",
                "88040768887359488920684063662636263144",
                "261181128275942906989041469058007366130",
                "273692825390960723784590646033102080069",
                "78881389671085679993268463799520745211",
                "20130397915617735466555546203535780614",
                "216911670466023796988816705829835011891",
                "288132418411806145782358814540256580822",
                "113305592080762206442088701198667253556",
                "58205792533074696926435022106754051123",
                "261261749161712135754035223797938291234",
                "86884672537363509766585677969069095060",
                "251126798650624693097678787510255457357",
                "150576646346524657179740325889937764596",
                "325107869011606585852672325228779076300",
                "330968840711807808693548311305589674000",
                "253913046909519922021951469730360547772",
                "195601001301800142634805635081921028013"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "print_gvars",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-a470b64a",
        "signature_type": "Function",
        "digest": {
            "function_hash": "94284623344387221029745170446616616816",
            "length": 2420.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    },
    {
        "target": {
            "function": "pdb_read_root",
            "file": "libr/bin/format/pdb/pdb.c"
        },
        "id": "CVE-2026-40499-d6ec6c34",
        "signature_type": "Function",
        "digest": {
            "function_hash": "30861160681323452594609331287348141350",
            "length": 1641.0
        },
        "signature_version": "v1",
        "source": "https://github.com/radareorg/radare2/commit/5590c87deeb7eb2a106fd7aab9ca88bfeebb7397",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:08Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40499.json"