CVE-2026-4946

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-4946

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4946.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-4946

Aliases

GHSA-mc3p-mq2p-xw6v

Published

2026-03-29T19:35:30.692Z

Modified

2026-07-15T15:56:22.190534Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

NSA Ghidra Auto-Analysis Annotation Command Execution

Details

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4946.json",
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "AHA"
}

References

Affected packages

Git / github.com/nationalsecurityagency/ghidra

Affected ranges

Type

GIT

Repo

https://github.com/nationalsecurityagency/ghidra

Events

Introduced

Fixed

09f14c92d3da6e5d5f6b7dea115409719db3cce1

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.0.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Ghidra_10.*

Ghidra_10.3_build

Ghidra_12.*

Ghidra_12.0.1_build

Ghidra_12.0.2_build

Ghidra_12.0_build

Ghidra_9.*

Ghidra_9.0.1_build

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14452560219353461874682079616675760102",
                "241878227154669002884272489390380470983",
                "218711909065982768287021434254879024722",
                "38661557862576582862024771976370105508",
                "210494956023312644073447038487532306819",
                "26950389001681389779894752331159027220",
                "44134878735772219776368491806952433447",
                "16796979239897166686115193572286690222"
            ]
        },
        "id": "CVE-2026-4946-18a71f2c",
        "signature_type": "Line",
        "target": {
            "file": "Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java"
        }
    },
    {
        "source": "https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "155739949213535221348782618684453007072",
            "length": 1444.0
        },
        "id": "CVE-2026-4946-7e1d5bb7",
        "signature_type": "Function",
        "target": {
            "function": "generatePkiCerts",
            "file": "Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java"
        }
    }
]

vanir_signatures_modified

"2026-07-15T15:56:22Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4946.json"