CVE-2026-26208

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26208", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-11T19:56:24.814Z", "datePublished": "2026-02-13T18:48:56.398Z", "dateUpdated": "2026-02-13T19:21:56.476Z"}, "containers": {"cna": {"title": "ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/issues/294", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/issues/294"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020"}], "affected": [{"vendor": "Alex4SSB", "product": "ADB-Explorer", "versions": [{"version": "< Beta 0.9.26020", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T18:48:56.398Z"}, "descriptions": [{"lang": "en", "value": "ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020."}], "source": {"advisory": "GHSA-49qx-wpxj-p4mh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T19:21:34.740562Z", "id": "CVE-2026-26208", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:21:56.476Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26208", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-11T19:56:24.814Z", "datePublished": "2026-02-13T18:48:56.398Z", "dateUpdated": "2026-02-13T19:21:56.476Z"}, "containers": {"cna": {"title": "ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/issues/294", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/issues/294"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a"}, {"name": "https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020", "tags": ["x_refsource_MISC"], "url": "https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020"}], "affected": [{"vendor": "Alex4SSB", "product": "ADB-Explorer", "versions": [{"version": "< Beta 0.9.26020", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T18:48:56.398Z"}, "descriptions": [{"lang": "en", "value": "ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020."}], "source": {"advisory": "GHSA-49qx-wpxj-p4mh", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26208", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T19:21:34.740562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:21:48.389Z"}}]}}

{"affected": [{"affectedData": [{"product": "ADB-Explorer", "vendor": "Alex4SSB", "versions": [{"status": "affected", "version": "< Beta 0.9.26020"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020."}, {"lang": "es", "value": "ADB Explorer es una interfaz de usuario fluida para ADB en Windows. Antes de la Beta 0.9.26020, ADB Explorer es vulnerable a deserializaci\u00f3n insegura que conduce a ejecuci\u00f3n remota de c\u00f3digo. La aplicaci\u00f3n intenta deserializar el archivo de configuraci\u00f3n App.txt usando Newtonsoft.Json con TypeNameHandling configurado en Objects. Esto permite a un atacante proporcionar un archivo JSON manipulado que contiene una cadena de gadgets (por ejemplo, ObjectDataProvider) para ejecutar c\u00f3digo arbitrario cuando la aplicaci\u00f3n se inicia y posteriormente guarda su configuraci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la Beta 0.9.26020."}], "id": "CVE-2026-26208", "lastModified": "2026-06-17T10:25:56.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26208", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T19:21:34.740562Z", "version": "2.0.3"}}]}, "published": "2026-02-13T19:17:29.420", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a"}, {"source": "security-advisories@github.com", "url": "https://github.com/Alex4SSB/ADB-Explorer/issues/294"}, {"source": "security-advisories@github.com", "url": "https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020"}, {"source": "security-advisories@github.com", "url": "https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.26020)"}}], "product": "adb-explorer", "vendor": "alex4ssb"}], "analysis": {"en": {"generated_at": "2026-04-18T18:07:35.938080+00:00", "value": {"mitigation_remediation": ["Update ADB Explorer to any release version equal to or newer than Beta\u202f0.9.26020, which removes the insecure deserialization handling.", "If an upgrade cannot be applied immediately, replace the existing App.txt with a clean copy from a trusted source and set its file permissions to read\u2011only for all users to prevent an attacker from supplying a malicious version; consider restricting write access to the directory containing App.txt.", "Configure Newtonsoft.Json in the application (if exposed to code changes) to disallow TypeNameHandling by setting TypeNameHandling to None or limiting it to specific trusted types."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "This flaw exists in all versions of ADB Explorer released by Alex4SSB before Beta 0.9.26020. The fix was applied in the Beta 0.9.26020 release, and any installed instance running a prior version remains vulnerable.", "description_and_impact": "ADB Explorer deserializes the App.txt settings file with Newtonsoft.Json configured to allow object type handling, creating an insecure deserialization vulnerability. A crafted JSON file containing a gadget chain, such as ObjectDataProvider, can be supplied as App.txt and will cause the application to execute arbitrary code when it runs and subsequently saves its settings, resulting in compromise of the host\u2019s integrity and confidentiality.", "risk_and_exploitability": "The CVSS score of 7.8 reflects high severity, while the EPSS score of less than 1% indicates a low but non\u2011zero likelihood of exploitation. The likely attack vector is an attacker who can place a malicious App.txt file\u2014through social engineering of a local user, a compromised account, or physical access\u2014to trigger the payload when the application starts. Although the vulnerability is not listed in CISA\u2019s KEV catalog and no public exploit has been documented, the mechanic permits full remote code execution on the host, making immediate patching a top priority."}}}}, "created": "2026-02-13T21:28:26.407260+00:00", "updated": "2026-04-18T18:15:06.598954+00:00", "vendors": ["alex4ssb", "alex4ssb$PRODUCT$adb-explorer"]}