CVE-2026-4946: NSA Ghidra Auto-Analysis Annotation Command Execution
Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.0.3 - Compensating control
Do not interact with/execute clickable annotation directives in UI text that originate from auto-analysis of untrusted binaries; treat any @execute-like content from extracted/comment data as potentially malicious until Ghidra is upgraded to 12.0.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4946?
CVE-2026-4946 has a critical severity rating due to the potential for arbitrary command execution.
How do I fix CVE-2026-4946?
To fix CVE-2026-4946, update your Ghidra installation to version 12.0.3 or later.
What types of systems are vulnerable to CVE-2026-4946?
CVE-2026-4946 affects all versions of Ghidra prior to 12.0.3.
What are the risks associated with CVE-2026-4946?
The risks include unauthorized command execution which could compromise system integrity and security.
How does CVE-2026-4946 exploit the Ghidra platform?
CVE-2026-4946 exploits improperly processed annotation directives within the Ghidra UI during binary analysis.