---
id: "CVE-2026-108387"
kind: "vulnerability"
aliases: ["CVE-2026-108387"]
title: "radare2: crafted binary can run commands when opened"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "package", "radare2", "reverse-engineering", "security-research"]
not_affected_if: ["trusted-binaries-only", "version-6.2.2-or-later"]
published_at: "2026-11-04T23:17:18+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:31:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108387", "first_seen_at": "2026-11-05T00:30:59+00:00"}]
exploit_sources: []
---

# radare2: crafted binary can run commands when opened

radare2 is a reverse engineering toolkit; before 6.2.2, opening or analyzing a crafted Pebble or Sega Mega Drive binary could make it reopen the file through its debug plugin. That path passes attacker-controlled arguments to execvp(), so commands run with the privileges of the radare2 process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `r2 -v` and compare it with the fixed version below.
- Look for radare2 use on analysis workstations or CI jobs that open untrusted binaries.

## Fix

- radare2: `6.2.2`

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108387

## Documents

- [advisory] Vendor advisory: github.com https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf
- [fix] Patch: github.com https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76
- [fix] Patch: github.com https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a
- [fix] Release notes: github.com https://github.com/radareorg/radare2/releases/tag/6.2.2

## From the sources

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_