CVE-2026-108387 · Package
NO FIX YET · SEE WHAT TO DO
radare2 is a reverse engineering toolkit; before 6.2.2, opening or analyzing a crafted Pebble or Sega Mega Drive binary could make it reopen the file through its debug plugin. That path passes attacker-controlled arguments to execvp(), so commands run with the privileges of the radare2 process.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone who runs radare2 before 6.2.2 to open or analyze binaries from outside their own control, such as malware samples, firmware or files from third parties. Teams that only analyze their own trusted binaries on isolated machines have less exposure. unknown whether other binary format plugins are affected beyond the Pebble and Sega Mega Drive cases in the description.
Not affected if trusted-binaries-only, version-6.2.2-or-later
Who cares ci, radare2, reverse-engineering, security-research
r2 -v and compare it with the fixed version below.6.2.2radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.