Command Injection Vulnerability in radare2 Framework by radareorg

CVE-2026-108387

What is CVE-2026-108387?

The radare2 reverse engineering framework is susceptible to a command injection vulnerability. This issue arises when attacker-controlled data from various binary format plugins manipulates the RBinInfo->bclass variable. By opening or analyzing a specially crafted Pebble or Sega Mega Drive binary, a malicious actor can insert a dbg:// URI into bclass, leading radare2 to automatically reopen the input via the debug input/output plugin. Consequently, this could result in the execution of arbitrary commands with the same privileges as the radare2 process without needing an explicit debugging command. This vulnerability has been addressed in version 6.2.2.

References