CVE-2026-26208: ADB Explorer RCE Vulnerability

CVE-2026-26208 Overview

CVE-2026-26208 is an Insecure Deserialization vulnerability in ADB Explorer, a fluent UI application for Android Debug Bridge (ADB) on Windows. Prior to Beta 0.9.26020, the application is vulnerable to remote code execution through malicious JSON deserialization. The vulnerability exists because the application deserializes the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects, allowing attackers to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings.

Critical Impact

An attacker can achieve arbitrary code execution on the victim's system by placing a malicious App.txt settings file in the application's directory. This could lead to complete system compromise, data theft, or installation of malware.

Affected Products

• ADB Explorer versions prior to Beta 0.9.26020
• Windows systems running vulnerable ADB Explorer installations

Discovery Timeline

• 2026-02-13 - CVE-2026-26208 published to NVD
• 2026-02-13 - Last updated in NVD database

Technical Details for CVE-2026-26208

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The core issue stems from the application's use of Newtonsoft.Json's TypeNameHandling.Objects setting when deserializing the App.txt configuration file. This setting instructs the JSON deserializer to include and process type information embedded within the JSON data, which enables the instantiation of arbitrary .NET types during deserialization.

When an attacker crafts a malicious App.txt file containing a serialized gadget chain, the application will automatically deserialize and instantiate these objects upon startup. Common .NET deserialization gadgets like ObjectDataProvider can be leveraged to execute arbitrary system commands or load malicious assemblies.

Root Cause

The root cause of this vulnerability is the unsafe configuration of the Newtonsoft.Json deserializer. By setting TypeNameHandling to Objects, the application allows type metadata embedded in JSON to dictate which .NET types are instantiated during deserialization. This pattern is known to be dangerous when processing untrusted input, as it enables attackers to specify arbitrary types that execute code during their construction or property setting operations.

Attack Vector

The attack vector for CVE-2026-26208 requires local access to the system where ADB Explorer is installed. An attacker must be able to place or modify the App.txt settings file in the application's directory. This could occur through various means:

1. A malicious application or script running with user privileges could write the malicious settings file
2. An attacker with physical access to the machine could plant the file
3. Social engineering could trick a user into downloading and placing a malicious configuration file

When the victim launches ADB Explorer, the application reads and deserializes the App.txt file, triggering the gadget chain and executing the attacker's payload. The vulnerability is particularly dangerous because the malicious code executes in the context of the user running ADB Explorer.

The exploitation leverages well-known .NET deserialization gadgets such as ObjectDataProvider, which can invoke arbitrary methods including System.Diagnostics.Process.Start() to execute system commands. For technical details on the exploitation mechanism, refer to the GitHub Security Advisory GHSA-49qx-wpxj-p4mh.

Detection Methods for CVE-2026-26208

Indicators of Compromise

• Unexpected modifications to the App.txt settings file in the ADB Explorer installation directory
• Presence of $type keys within the App.txt JSON file, indicating embedded type metadata
• References to suspicious .NET types such as ObjectDataProvider, TypeConfuseDelegate, or System.Diagnostics.Process in configuration files
• Unusual process spawning from the ADB Explorer process

Detection Strategies

• Monitor file system changes to ADB Explorer's configuration directory for unauthorized modifications
• Implement application whitelisting to detect unexpected child processes spawned by ADB Explorer
• Deploy endpoint detection rules to flag JSON files containing known deserialization gadget patterns
• Use file integrity monitoring (FIM) to detect tampering with application configuration files

Monitoring Recommendations

• Enable detailed process creation logging (Windows Event ID 4688) with command line auditing
• Monitor for suspicious parent-child process relationships where ADB Explorer spawns unexpected executables
• Review application logs for JSON parsing errors that may indicate attempted exploitation
• Implement behavioral analysis to detect anomalous activity following ADB Explorer execution

How to Mitigate CVE-2026-26208

Immediate Actions Required

• Update ADB Explorer to Beta 0.9.26020 or later immediately
• Verify the integrity of existing App.txt configuration files before launching the application
• Remove any suspicious $type entries from configuration files
• Consider temporarily uninstalling vulnerable versions until the patch can be applied

Patch Information

The vulnerability has been fixed in ADB Explorer Beta 0.9.26020. The fix involves changing the JSON deserialization settings to prevent arbitrary type instantiation. Users should download the patched version from the official GitHub Release v0.9.26020.

The specific commit addressing this vulnerability can be reviewed at GitHub Commit Details.

Workarounds

• If unable to update immediately, remove or rename the App.txt file and allow the application to regenerate it with default settings
• Restrict write permissions on the ADB Explorer installation directory to prevent unauthorized modification of configuration files
• Run ADB Explorer in a sandboxed environment or virtual machine until the patch is applied
• Monitor the application's behavior for any signs of compromise if the vulnerable version must be used temporarily

# Verify ADB Explorer version and remove potentially compromised settings
# Check current installation directory for suspicious configuration
dir "%LOCALAPPDATA%\ADB Explorer\App.txt"

# Backup and remove the settings file to force regeneration
move "%LOCALAPPDATA%\ADB Explorer\App.txt" "%LOCALAPPDATA%\ADB Explorer\App.txt.backup"

# Restrict write access to configuration directory (run as Administrator)
icacls "%LOCALAPPDATA%\ADB Explorer" /deny Everyone:(W)