Vulnerability · Published Feb 13, 2026 · Assigned by GitHub_M

CVE-2026-26208ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization

High 7.8

In plain English

A high-severity unsafe deserialization in ADB-Explorer from Alex4SSB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020.

Affected products (as reported)

Vendor	Product	Versions
Alex4SSB	ADB-Explorer	< Beta 0.9.26020

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh x_refsource_CONFIRM
https://github.com/Alex4SSB/ADB-Explorer/issues/294 x_refsource_MISC
https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a x_refsource_MISC
https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020 x_refsource_MISC