PT-2026-28677 · Nsa · Ghidra

Todb · Publicado 2026-03-29 · Atualizado 2026-04-02 · CVE-2026-4946

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.0.3

Description The software improperly processes annotation directives embedded in automatically extracted binary data, leading to arbitrary command execution when a user interacts with the user interface. The @execute annotation, designed for trusted, user-authored comments, is also parsed in comments generated during auto-analysis, such as CFStrings in Mach-O binaries. This allows a crafted binary to present clickable text that, when clicked, executes attacker-controlled commands on the analyst’s machine.

Recommendations Upgrade to a version prior to 12.0.3.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-4946

Produtos afetados

Ghidra

Referências · 10

• 🔥 https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110 · Exploit
• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v · Aviso do Fabricante
• https://twitter.com/IceSolst/status/2038756537519223073 · Publicação no Twitter
• https://twitter.com/battista212/status/2039766347463155934 · Publicação no Twitter
• https://twitter.com/bigmacd16684/status/2039714138989924759 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4946 · Nota de Segurança
• https://twitter.com/ksg93rd/status/2038957192703827976 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038350059176358105 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038516977317429311 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2038348508873236845 · Publicação no Twitter