What’s Vulnerable › Vulnerabilities

CVE-2026-4946: NSA Ghidra Auto-Analysis Annotation Command Execution

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-29 · updated 2026-08-10
• Weakness: CWE-78

Description

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.

Affected products

• nationalsecurityagency ghidra: before 12.0.3 — fixed in 12.0.3

How to fix

Upgrade to a fixed version: nationalsecurityagency ghidra 12.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110

Get alerted when CVE-2026-4946 or the next vulnerability affects your stack