Read the docs
TI-2026-85257 Aliases CVE-2026-108387

Command execution in radare2 via crafted Pebble or Mega Drive binary

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

radare2 before 6.2.2 is affected. Binary format plugins let attacker-controlled data reach the bclass field, so opening or analyzing a crafted Pebble or Sega Mega Drive binary passes attacker-controlled arguments to execvp(), an OS command injection flaw (CWE-78). A local attacker needs a user to open or analyze the crafted file, and the injected commands run with the privileges of the radare2 process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.

Why it matters now

EPSS 0.0015 4th percentileScored 2026-11-07
Fix Fixed radare2 (radareorg): 6.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
radareorgradare2before 6.2.26.2.2Patch availableCNA
  • radare2 Vendorradareorg Affected before 6.2.2 Fixed in 6.2.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*——radareorg
  • cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:* Versions — — ·radareorg

Remediation

Upgrade radare2 to version 6.2.2, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA radare2 (radareorg) Fixed in 6.2.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-108387
  2. 2026-11-06 Priority changed: MEDIUM → LOW
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 5

  • TI-2023-25089 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function… CVSS 3.1CRITICAL 9.8
  • TI-2023-25088 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu… CVSS 3.1CRITICAL 9.8
  • TI-2021-12172 Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. CVSS 3.1CRITICAL 10.0
  • TI-2026-06081 radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-07640 radare2 6.1.5 Use-After-Free via gdbr_pids_list() CVSS 4.0HIGH 8.7
  • TI-2026-07639 radare2 6.1.5 Use-After-Free via gdbr_threads_list() CVSS 4.0HIGH 8.7
See all 183 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences