Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108387— radare2: Remote code execution when loading Pebble/SMD binary

Quick assessment

Affected
radareorg radare2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

radare2 是一个类 UNIX 的反工程框架及命令行工具集。在 6.2.2 版本之前，攻击者控制的数据可能通过多个二进制格式插件传递至 RBinInfo->bclass。若打开或分析一个经过篡改的 Pebble 或 Sega Mega Drive 二进制文件，攻击者可将一个 dbg:// URI 植入 bclass 字段，导致 radare2 通过调试输入/输出插件重新打开该输入文件，并最终将攻击者控制的参数传递给 execvp() 函数。这使得攻击者能够在未显式执行调试命令的情况下，以 radare2 进程的

CVSS 8.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108387

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
radare2: Remote code execution when loading Pebble/SMD binary
Source: CVE Program / CVE List V5
Vulnerability Description
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
radareorg radare2 < 6.2.2 -

II. Public POCs for CVE-2026-108387

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108387

请登录查看更多情报信息。

Other References for CVE-2026-108387 (5)

IV. Related Vulnerabilities

Same product: radare2
Same vendor: radareorg
Same weakness: CWE-78