A critical command injection vulnerability in the radare2 PDB parser allows for arbitrary code execution when processing malicious PDB files.

The vulnerability exists in the print_gvars() function within the PDB parser. An attacker can inject arbitrary shell commands by crafting a PDB file with newline characters in symbol names, which are then improperly interpolated and executed when a user runs the idp command.

Successful exploitation of this flaw allows an attacker to achieve full remote code execution on the system of any user who analyzes a malicious PDB file. Given the tool's usage in security research and reverse engineering, this poses a severe risk of persistent system compromise, data theft, and lateral movement within an organization. The CVSS score of 7.8 reflects a high-severity risk to system integrity and availability.

Immediate Action: Update the radare2 framework to version 6.1.4 or later immediately.

Proactive Monitoring: Monitor system logs for suspicious process spawning or unexpected shell command execution originating from the radare2 process.

Compensating Controls: Avoid opening PDB files or binaries from untrusted sources until the software has been updated. Users should exercise caution when processing files from external repositories or unknown contributors.

Public Exploit Available: Yes — a proof-of-concept generator is available via the researcher's published write-up at the blog.calif.io reference.

This vulnerability represents a significant security risk for any organization utilizing the radare2 framework for binary analysis. Because a proof-of-concept is publicly documented and the mechanism for exploitation is straightforward, administrators must prioritize patching to version 6.1.4. Failure to apply this update leaves users exposed to potential full system compromise whenever untrusted binaries are analyzed.