In versions of ADB-Explorer released before Beta 0.9.26022, the system allows the ManualAdbPath setting to be defined as a UNC path in the application’s settings file. If an attacker supplies a custom configuration file that points the binary path to a remote network share, the application will download and run the remote binary. The attacker can thus execute arbitrary code on the victim’s machine with the privileges of the user running ADB‑Explorer. The vulnerability is a type of uncontrolled input flaw that permits arbitrary code execution on the local system.

The affected product is Alex4SSB ADB‑Explorer, a Windows‑based fluent UI for ADB. All installations of the product older than Beta 0.9.26022 are susceptible. The vulnerability is present only in Windows builds of the application and requires a user to launch the app using a malicious settings file.

The CVSS v3.1 score of 8.8 indicates a high‑severity flaw. The EPSS probability is reported as less than 1%, suggesting that exploitation may not be widespread at present, yet the availability of a fix and the high impact make it a priority. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open a shortcut that references a user‑supplied settings file, a scenario that typically involves social engineering. Once the shortcut is executed, the remote binary is run under the user's account, enabling full control of the victim system.