radare2 versions older than 6.1.4 contain a command injection flaw in the PDB parser’s print_gvars() function. An attacker can embed a newline byte in a PE section header name field and craft a malicious PDB file so that r2 commands are injected and executed when the idp command processes the file. This weakness is an OS command injection (CWE‑78) that allows the execution of arbitrary commands in the environment where radare2 runs.

The vulnerability affects radare2 from radareorg, all releases prior to 6.1.4. Users running 6.0.x, 6.1.0, 6.1.1, 6.1.2 or 6.1.3 are impacted. Version 6.1.4 and later contain the fix.

The CVSS score of 8.4 classifies this as a high severity vulnerability. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker must be able to supply a malicious PDB file to radare2. If the tool processes user‑controlled PDB data, the attacker can execute arbitrary r2 commands, potentially escalating to system‑level commands. The absence of a publicly known exploitable pattern suggests the exploitability is moderate, but the high severity and ability to impact the user’s environment warrant prompt remediation.