CVE-2026-4946

Description

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.

PUBLISHED Reserved 2026-03-27 | Published 2026-03-29 | Updated 2026-03-30 | Assigner AHA

Problem types

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Product status

Credits

Mobasi Security Team finder

todb of AHA! coordinator

References

takeonme.org/...00000000000000000000000000000000000000000110 exploit

takeonme.org/...00000000000000000000000000000000000000000110 third-party-advisory

github.com/...ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v vendor-advisory

cve.org (CVE-2026-4946)

nvd.nist.gov (CVE-2026-4946)

Download JSON