CVE Explorer

CVE-2026-26208

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnera

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c442e3a0c02fb0e6734dc7837e3a65ddc42b1841d57148d85d9ccb85a9047c76

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"ADB-Explorer","vendor":"Alex4SSB","versions":[{"status":"affected","version":"< Beta 0.9.26020"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"name":"https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a","tags":["x_refsource_MISC"],"url":"https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/references/2

{"name":"https://github.com/Alex4SSB/ADB-Explorer/issues/294","tags":["x_refsource_MISC"],"url":"https://github.com/Alex4SSB/ADB-Explorer/issues/294"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/references/1

{"name":"https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020","tags":["x_refsource_MISC"],"url":"https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/references/3

{"name":"https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a20a21798040b7c837991dabb256cd0879e425550d2a5367f309dd8b29983fef · sha256:133a5431c1192dd3… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer