{"id":"CVE-2026-18718","title":"Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path","summary":"Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a vict…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-427"],"vendor":"National Security Agency","product":"Ghidra","affected":["Ghidra < 12.1.2"],"published":"2026-08-03","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:44:42.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18718","references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-853f-q3gh","label":"disclosure@vulncheck.com"},{"url":"https://github.com/sn0x-sharma/CVE-2026-18718","label":"disclosure@vulncheck.com"},{"url":"https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-found-a-0-day-in-ghidra-shared-project-file-became-a-code-execution-vector","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-code-execution-via-project-state","label":"disclosure@vulncheck.com"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00174,"epssPercentile":0.06077,"exploits":{"github":1,"githubRepos":["https://github.com/sn0x-sharma/CVE-2026-18718"],"checkedAt":"2026-09-24T20:52:15.404Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-08-03T21:17:08.036410Z"},"ingestedAt":"2026-09-24T15:45:56.735Z","slug":"CVE-2026-18718","body":"## Overview\n\nGhidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}