---
id: CVE-2026-18718
title: >-
  Ghidra contains an arbitrary code execution vulnerability in the Swift
  demangler analyzer that allows an attacker to execute arbitrary binaries by
  supplying a malicious Ghidra project with a crafted Swift tool directory path
summary: >-
  Ghidra contains an arbitrary code execution vulnerability in the Swift
  demangler analyzer that allows an attacker to execute arbitrary binaries by
  supplying a malicious Ghidra project with a crafted Swift tool directory path.
  When a vict…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-427
vendor: National Security Agency
product: Ghidra
affected:
  - Ghidra < 12.1.2
published: '2026-08-03'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:44:42.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18718'
references:
  - url: 'https://github.com/NationalSecurityAgency/ghidra'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-853f-q3gh
    label: disclosure@vulncheck.com
  - url: 'https://github.com/sn0x-sharma/CVE-2026-18718'
    label: disclosure@vulncheck.com
  - url: >-
      https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-found-a-0-day-in-ghidra-shared-project-file-became-a-code-execution-vector
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-code-execution-via-project-state
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00174
epssPercentile: 0.06129
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/sn0x-sharma/CVE-2026-18718'
  checkedAt: '2026-09-26T09:05:39.448Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-03T21:17:08.036410Z'
ingestedAt: '2026-09-24T15:45:56.735Z'
---

## Overview

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.