CVE-2026-108387
Severity not reportedradare2 is a UNIX-like reverse engineering framework and command-line toolset.
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76 security-advisories@github.com
- https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a security-advisories@github.com
- https://github.com/radareorg/radare2/issues/26600 security-advisories@github.com
- https://github.com/radareorg/radare2/releases/tag/6.2.2 security-advisories@github.com
- https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf security-advisories@github.com