{"id":"CVE-2026-4946","summary":"NSA Ghidra Auto-Analysis Annotation Command Execution","details":"Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.","aliases":["GHSA-mc3p-mq2p-xw6v"],"modified":"2026-07-15T15:56:22.190534Z","published":"2026-03-29T19:35:30.692Z","database_specific":{"cna_assigner":"AHA","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4946.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4946.json"},{"type":"ADVISORY","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4946"},{"type":"ADVISORY","url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nationalsecurityagency/ghidra","events":[{"introduced":"0"},{"fixed":"09f14c92d3da6e5d5f6b7dea115409719db3cce1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"12.0.3"}],"source":"AFFECTED_FIELD"}}],"versions":["Ghidra_12.0.2_build","Ghidra_12.0.1_build","Ghidra_12.0_build","Ghidra_10.3_build","Ghidra_9.0.1_build"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4946.json","vanir_signatures_modified":"2026-07-15T15:56:22Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1","target":{"file":"Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java"},"deprecated":false,"digest":{"line_hashes":["14452560219353461874682079616675760102","241878227154669002884272489390380470983","218711909065982768287021434254879024722","38661557862576582862024771976370105508","210494956023312644073447038487532306819","26950389001681389779894752331159027220","44134878735772219776368491806952433447","16796979239897166686115193572286690222"],"threshold":0.9},"id":"CVE-2026-4946-18a71f2c","signature_type":"Line"},{"digest":{"function_hash":"155739949213535221348782618684453007072","length":1444},"id":"CVE-2026-4946-7e1d5bb7","signature_type":"Function","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1","target":{"file":"Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java","function":"generatePkiCerts"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}