radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()

radare2, a popular reverse engineering tool, has a flaw in how it reads PDB debug files. An attacker can create a malicious PDB file with hidden commands in the section names, which get executed when the tool processes it, allowing them to run arbitrary code.

The PDB parser's print_gvars() function fails to properly sanitize section header names, allowing command injection through embedded newline bytes. When the idp command processes a crafted PDB file, unsanitized input is passed to a command execution context, enabling arbitrary command execution on the analyst's system.