CVE-2026-52751: Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1 - Configuration
Disable or avoid using the client-side Shared-Project RMI connection feature (Shared Project) until Ghidra is upgraded to 12.1.
Ghidra (client Shared-Project RMI) shared_project_rmi_connection = disabled - Configuration
Do not open project files via ghidra:// URLs; unregister the ghidra:// protocol handler or otherwise block opening ghidra:// links until the product is patched.
Ghidra (URL handling) ghidra:// protocol handling = do not open/unregister - Configuration
Disable Jython scripting support or remove the bundled Jython runtime to prevent exploitation via the Jython 2.7.4 gadget chain until Ghidra is patched.
Ghidra (Jython scripting) jython_enabled = false - Compensating control
Restrict or block access to Shared-Project RMI endpoints from untrusted networks using firewall rules, ACLs, or network segmentation to prevent unauthenticated RMI connections.
- Operational
If untrusted ghidra project files were opened, assume potential compromise: investigate affected hosts, perform forensics, rotate any potentially exposed credentials, and restore systems from known-good backups as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52751?
CVE-2026-52751 has a high severity rating of 8.6.
How do I fix CVE-2026-52751?
To fix CVE-2026-52751, upgrade to Ghidra version 12.1 or later where the vulnerability has been patched.
What type of attack does CVE-2026-52751 enable?
CVE-2026-52751 enables unauthenticated remote code execution due to unsafe deserialization.
Is there a patch available for CVE-2026-52751?
Yes, a patch is available in Ghidra version 12.1 to mitigate CVE-2026-52751.
What software does CVE-2026-52751 affect?
CVE-2026-52751 affects the National Security Agency's Ghidra software before version 12.1.