CVE-2026-108387

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.2

Description An issue exists where attacker-controlled data from binary format plugins can reach RBinInfo->bclass. When opening or analyzing a specially crafted Pebble or Sega Mega Drive binary, a dbg:// URI can be placed in bclass, causing the application to reopen the input via the debug input/output plugin. This process allows attacker-controlled arguments to be passed to the execvp() function, leading to arbitrary command execution with the privileges of the process without requiring an explicit debugging command.

Recommendations Update to version 6.2.2.