Ghidra vulnerabilities

2 known vulnerabilities in Ghidra from NSA. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Ghidra: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-4946Mar 29, 2026NSA

  Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended f

• 9.8 Critical severity

  Ghidra: Improper Neutralization of Special Elements used in a Command

  CVE-2023-22671Jan 6, 2023NSAEPSS 2.95%

  Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.