Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M

CVE-2026-108387radare2: Remote code execution when loading Pebble/SMD binary

High 8.5

In plain English

A high-severity OS command injection in radare2 from radareorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.1%top 95.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:26.04:LTS	radare2	no fix listed	UBUNTU-CVE-2026-108387
Ubuntu:26.10	radare2	no fix listed	UBUNTU-CVE-2026-108387

Affected products (as reported)

Vendor	Product	Versions
radareorg	radare2	< 6.2.2

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf x_refsource_CONFIRM
https://github.com/radareorg/radare2/issues/26600 x_refsource_MISC
https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76 x_refsource_MISC
https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a x_refsource_MISC
https://github.com/radareorg/radare2/releases/tag/6.2.2 x_refsource_MISC