CVE-2026-4946: RCE in Ghidra 12.0.3 and Prior

The impact of CVE-2026-4946 is significant. A successful exploit allows an attacker to execute arbitrary code within the context of the Ghidra process, effectively gaining control over the analyst's machine. This could involve installing malware, stealing sensitive data, or pivoting to other systems on the network. The vulnerability is particularly concerning because it targets reverse engineers and security analysts, who often work with potentially malicious code. The attack vector involves crafting a binary containing malicious annotation directives, which are then processed by Ghidra during auto-analysis. The resulting clickable text appears benign, tricking the analyst into executing the attacker's commands. This resembles social engineering tactics combined with technical exploitation, making detection challenging.

1. Reserved2026-03-27
2. Published2026-03-29
3. Modified2026-03-30
4. EPSS updated2026-04-06

The primary mitigation for CVE-2026-4946 is to upgrade Ghidra to version 12.0.3 or later. This version includes a fix that properly handles annotation directives, preventing the arbitrary command execution. If upgrading is not immediately feasible, consider isolating Ghidra instances used for analyzing potentially malicious binaries. Restrict network access for these instances to minimize the potential for lateral movement. Carefully review any automatically generated comments or annotations within Ghidra, especially those originating from external binaries. While a WAF or proxy cannot directly mitigate this vulnerability, implementing strict input validation and sanitization on any data processed by Ghidra could provide a secondary layer of defense. After upgrading, confirm the fix by analyzing a known malicious binary that previously triggered the vulnerability and verifying that no commands are executed.