ADB Explorer deserializes the App.txt settings file with Newtonsoft.Json configured to allow object type handling, creating an insecure deserialization vulnerability. A crafted JSON file containing a gadget chain, such as ObjectDataProvider, can be supplied as App.txt and will cause the application to execute arbitrary code when it runs and subsequently saves its settings, resulting in compromise of the host’s integrity and confidentiality.

This flaw exists in all versions of ADB Explorer released by Alex4SSB before Beta 0.9.26020. The fix was applied in the Beta 0.9.26020 release, and any installed instance running a prior version remains vulnerable.

The CVSS score of 7.8 reflects high severity, while the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The likely attack vector is an attacker who can place a malicious App.txt file—through social engineering of a local user, a compromised account, or physical access—to trigger the payload when the application starts. Although the vulnerability is not listed in CISA’s KEV catalog and no public exploit has been documented, the mechanic permits full remote code execution on the host, making immediate patching a top priority.