PT-2026-28677 · Nsa · Ghidra

Todb · Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-4946

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.0.3

Description The software improperly processes annotation directives embedded in automatically extracted binary data, leading to arbitrary command execution when a user interacts with the user interface. The @execute annotation, designed for trusted, user-authored comments, is also parsed in comments generated during auto-analysis, such as CFStrings in Mach-O binaries. This allows a crafted binary to present clickable text that, when clicked, executes attacker-controlled commands on the analyst’s machine.

Recommendations Upgrade to a version prior to 12.0.3.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-4946

Affected Products

Ghidra

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4946 · Security Note
• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v · Vendor Advisory
• https://twitter.com/CveFindCom/status/2038348508873236845 · Twitter Post
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110 · Note
• https://twitter.com/TheHackerWire/status/2038350059176358105 · Twitter Post