radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare2's shell execution operator.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.4 · radareNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*
References 4
- https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero Exploit, Third Party Advisory
- https://github.com/radareorg/radare2/issues/25730 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/radareorg/radare2/pull/25731 Issue Tracking
- https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-symbol-names Third Party Advisory