{"id":"CVE-2026-108387","kind":"vulnerability","aliases":["CVE-2026-108387"],"related":[],"title":"radare2: crafted binary can run commands when opened","description":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.","summary":"radare2 is a reverse engineering toolkit; before 6.2.2, opening or analyzing a crafted Pebble or Sega Mega Drive binary could make it reopen the file through its debug plugin. That path passes attacker-controlled arguments to execvp(), so commands run with the privileges of the radare2 process.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","package","radare2","reverse-engineering","security-research"],"not_affected_if":["trusted-binaries-only","version-6.2.2-or-later"],"how_to_check":"- Check the installed version with `r2 -v` and compare it with the fixed version below.\n- Look for radare2 use on analysis workstations or CI jobs that open untrusted binaries.","fix":"- radare2: `6.2.2`","status":"open","published_at":"2026-11-04T23:17:18+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:47+00:00","updated_at":"2026-11-05T00:31:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T00:31:47Z","model":"claude-haiku-5-5","output":{"fix":"- radare2: `6.2.2`","reach":"local","title":"radare2: crafted binary can run commands when opened","impact":"high","summary":"radare2 is a reverse engineering toolkit; before 6.2.2, opening or analyzing a crafted Pebble or Sega Mega Drive binary could make it reopen the file through its debug plugin. That path passes attacker-controlled arguments to execvp(), so commands run with the privileges of the radare2 process.","audience":"developers","category":"package","nicknames":[],"who_cares":["radare2","reverse-engineering","security-research","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"commands run with the privileges of the radare2 process","analyst_note":"","how_to_check":"- Check the installed version with `r2 -v` and compare it with the fixed version below.\n- Look for radare2 use on analysis workstations or CI jobs that open untrusted binaries.","plain_action":"","needs_analyst":false,"not_affected_if":["version-6.2.2-or-later","trusted-binaries-only"],"who_is_affected":"Anyone who runs radare2 before 6.2.2 to open or analyze binaries from outside their own control, such as malware samples, firmware or files from third parties. Teams that only analyze their own trusted binaries on isolated machines have less exposure. unknown whether other binary format plugins are affected beyond the Pebble and Sega Mega Drive cases in the description.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4370,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108387':11A,14A '-2026':10A,13A '6.2.2':31B,88C,161C 'analyz':34B,104C 'argument':59B,136C 'attack':57B,90C,134C 'attacker-control':56B,89C,133C 'bclass':101C,118C 'binari':3A,42B,95C,112C 'caus':119C 'ci':15B 'command':6A,63B,83C,142C,154C 'command-lin':82C 'control':58B,91C,135C 'could':43B,98C,113C,140C 'craft':2A,36B,106C 'cve':9A,12A 'data':92C 'debug':51B,127C,153C 'drive':41B,111C 'engin':20B,28B,79C 'execut':141C 'execvp':61B,138C 'explicit':152C 'file':48B 'fix':158C 'format':96C 'framework':80C 'input':124C 'input/output':128C 'issu':156C 'like':77C 'line':84C 'make':44B 'mega':40B,110C 'open':8A,32B,102C 'packag':16B 'pass':55B,132C 'path':54B 'pebbl':37B,107C 'place':114C 'plugin':52B,97C,129C 'prior':86C 'privileg':67B,145C 'process':71B,149C 'radare2':1A,17B,24B,70B,72C,120C,148C 'rbininfo':100C 'reach':99C 'reopen':46B,122C 'research':23B 'revers':19B,27B,78C 'reverse-engin':18B 'run':5A,64B 'secur':22B 'security-research':21B 'sega':39B,109C 'sever':94C 'toolkit':29B 'toolset':85C 'ultim':131C 'unix':76C 'unix-lik':75C 'uri':116C 'version':160C 'without':150C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs radare2 before 6.2.2 to open or analyze binaries from outside their own control, such as malware samples, firmware or files from third parties. Teams that only analyze their own trusted binaries on isolated machines have less exposure. unknown whether other binary format plugins are affected beyond the Pebble and Sega Mega Drive cases in the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","high","package","radare2","reverseengineering","securityresearch"],"campaign_type":null,"first_public_at":"2026-09-03T12:11:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108387","severity":null,"published_at":"2026-11-04T23:17:18+00:00","modified_at":"2026-11-04T23:17:18+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71453,"url":"https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71454,"url":"https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71455,"url":"https://github.com/radareorg/radare2/releases/tag/6.2.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71456,"url":"https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:11:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}