CVE-2026-4946
Command Injection via @execute Annotation in Ghidra UI
Publication date: 2026-03-29
Last updated on: 2026-03-30
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| national_security_agency | ghidra | to 12.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4946 is a vulnerability in Ghidra versions prior to 12.0.3 where the software improperly processes annotation directives embedded in automatically extracted binary data. Specifically, the @execute annotation, which is intended only for trusted, user-authored comments, is also parsed in comments generated during automatic analysis of Mach-O binaries, such as CFStrings.
This flaw allows an attacker to craft a malicious binary that contains seemingly harmless clickable text in the comments. When an analyst interacts with this clickable text in Ghidra's user interface, it triggers the execution of attacker-controlled commands on the analyst's machine without any confirmation.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary command execution on the analyst's machine when they click on maliciously crafted clickable comments within Ghidra. The impact includes full compromise of the analyst's machine.
- Remote code execution requiring only user interaction (clicking the malicious comment).
- Execution of attacker-controlled commands such as exfiltrating sensitive files (e.g., SSH keys), opening applications, creating files, or launching phishing URLs.
- Low attack complexity with no privileges required.
Overall, this vulnerability poses a high security risk to users analyzing Mach-O binaries with vulnerable versions of Ghidra.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests when an analyst interacts with malicious clickable comments in Ghidra's UI, specifically those generated from Mach-O binaries containing crafted CFStrings with @execute annotations.
Detection involves identifying if Ghidra versions prior to 12.0.3 are in use and if any Mach-O binaries analyzed contain suspicious CFStrings with embedded @execute annotations.
Since the vulnerability triggers on user interaction within Ghidra, network or system-level detection commands are not directly provided in the available resources.
However, to check the Ghidra version installed, you can run commands like:
- On Linux/macOS: `ghidraRun --version` or check the version in the Ghidra UI under Help > About.
- On Windows: Check the Ghidra installation folder for version files or use the UI About dialog.
To detect suspicious Mach-O binaries, you might use binary analysis tools to extract CFStrings and search for '@execute' annotations, but no specific commands are provided in the resources.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade Ghidra to version 12.0.3 or later, where this vulnerability has been patched.
Until the upgrade is applied, analysts should avoid clicking on suspicious or unknown clickable comments in Ghidra's Listing view, especially those originating from Mach-O binaries.
Additional caution includes verifying the source and integrity of binaries before analysis to reduce exposure to crafted malicious Mach-O files.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows arbitrary command execution on an analyst's machine when interacting with maliciously crafted binaries in Ghidra. Such unauthorized code execution can lead to full compromise of the analyst's system, potentially exposing sensitive data.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the risk of unauthorized data access or exfiltration (e.g., SSH keys) could result in violations of data protection regulations that require safeguarding sensitive information.
Therefore, organizations using vulnerable versions of Ghidra may face compliance risks related to confidentiality, integrity, and availability of sensitive data if this vulnerability is exploited.