Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-18718: Ghidra Swift Demangler Analyzer Can Run Malicious Code

CVE-2026-18718 · published 3 months ago

Summary

If you open a malicious Ghidra project, an attacker could run their own code on your computer without your permission. This can happen if you open a project from an untrusted source. To stay safe, only open Ghidra projects from trusted sources.

What to do

Update national security agency ghidra to version 12.1.2 or later.

Affected software

Vendor	Product	Affected versions
national security agency	ghidra	< 12.1.2

Original advisory text

Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.

References

https://app.notion.com/p/Conditional-Arbitrary-Code-Execution-via-Swift-Demangle...
https://github.com/sn0x-sharma/CVE-2026-18718 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18718... Vendor Advisory
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-8... Vendor Advisory
https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-c... Vendor Advisory
https://github.com/NationalSecurityAgency/ghidra Product
https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-... Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18718 Vendor Advisory
https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-427Uncontrolled Search Path Element

Timeline

Published3 Aug 2026

Updated26 Oct 2026

First seen3 Aug 2026

Sources

CVE-2026-18718 · NVD

CVE-2026-18718 · MITRE

GHSA-pcfh-853f-q3gh · GHSA

CVE-2026-18718 · OSV

Track software like this

Free during beta