CVE-2026-52751

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NationalSecurityAgency/ghidra/commit/91a269103fe5d133c14ec3afa60280dccb94be5c	Patch
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fgg5-g275-7742	Exploit Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/ghidra-remote-code-execution-via-unfiltered-rmi-deserialization-in-shared-project-connection	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Ghidra anterior a 12.1 contiene una vulnerabilidad de deserialización insegura en el código de conexión RMI de proyecto compartido del lado del cliente que permite la ejecución remota de código no autenticada. Los atacantes pueden crear un archivo de proyecto malicioso con una URL ghidra:// que, al abrirse a través de File ? Open Project, deserializa objetos no confiables utilizando una cadena de gadgets de Jython 2.7.4 para ejecutar comandos arbitrarios.

Information

Published : 2026-06-10 14:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-52751

Mitre link : CVE-2026-52751

CVE.ORG link : CVE-2026-52751

JSON object : View

Products Affected

nsa

ghidra

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-52751", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52751", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T14:15:51.386472Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/nationalsecurityagency/ghidra", "vendor": "nationalsecurityagency", "product": "ghidra", "versions": [{"status": "affected", "version": "0", "lessThan": "12.1", "versionType": "custom"}, {"status": "unaffected", "version": "12.1", "versionType": "custom"}], "packageURL": "pkg:github/nationalsecurityagency/ghidra", "defaultStatus": "unaffected"}]}], "published": "2026-06-10T14:16:35.187", "references": [{"url": "https://github.com/NationalSecurityAgency/ghidra/commit/91a269103fe5d133c14ec3afa60280dccb94be5c", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fgg5-g275-7742", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ghidra-remote-code-execution-via-unfiltered-rmi-deserialization-in-shared-project-connection", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File \u2192 Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands."}, {"lang": "es", "value": "Ghidra anterior a 12.1 contiene una vulnerabilidad de deserializaci\u00f3n insegura en el c\u00f3digo de conexi\u00f3n RMI de proyecto compartido del lado del cliente que permite la ejecuci\u00f3n remota de c\u00f3digo no autenticada. Los atacantes pueden crear un archivo de proyecto malicioso con una URL ghidra:// que, al abrirse a trav\u00e9s de File ? Open Project, deserializa objetos no confiables utilizando una cadena de gadgets de Jython 2.7.4 para ejecutar comandos arbitrarios."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84A6A7C7-BC80-477A-B69D-700BF1208830", "versionEndExcluding": "12.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}