Deserialization in Alex4ssb Adb-Explorer

CVE-2026-26208

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020.

Vulnerability class: Insecure Deserialization

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.008 (55.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-26208: rose from 0.002 to 0.008.

EPSS over last 30 days · oldest: 0.002 · newest: 0.008 · change: +0.005

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-26208?
CVE-2026-26208 is a high-severity vulnerability in Alex4ssb Adb-Explorer, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2026-02-13.
How severe is CVE-2026-26208?
High severity. CVSS v3 base score is 7.8 out of 10.