CVE-2026-26208CWE-502

ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization

High · published February 13, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00772 · 55.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-02-13T18:48Z
EPSS history
Timeline
  • 13 FEB 18:48Z
    ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization
    cvelistv5