CVE-2026-52751: Ghidra Unsafe Deserialization Remote Code Execution (CVSS 8.8)

Technical summary

CVE-2026-52751 is an unsafe deserialization vulnerability in Ghidra's client-side Shared-Project RMI (Remote Method Invocation) connection handling. The vulnerability exists in code that processes project files referenced by ghidra:// URLs. When deserialization occurs, attackers can inject a Jython 2.7.4 gadget chain—a sequence of serialized Java objects that, when reconstructed, trigger arbitrary command execution. The lack of input validation or object type filtering during deserialization enables remote code execution without prior authentication. The attack vector is network-based and requires user interaction (opening a project file), but succeeds reliably against unpatched versions.

Business impact

Organizations using Ghidra for malware analysis, binary reversing, or security research face direct compromise of analyst workstations. An attacker can distribute a malicious .ghidra project file or craft a ghidra:// link and socially engineer analysts to open it, gaining code execution in the context of the analyst's user account. This could expose sensitive analysis work, exfiltrate reverse-engineering intelligence, or pivot to internal systems. For security teams relying on Ghidra in air-gapped or sensitive environments, this is particularly severe because the attack requires no network access beyond the initial file delivery.

Affected systems

NSA Ghidra versions prior to 12.1 are vulnerable. This includes all releases from initial publication through 12.0.x. Ghidra is available as a cross-platform Java application, so the vulnerability affects Windows, Linux, and macOS deployments equally. Vulnerability requires that a user actively opens a malicious project file via the File → Open Project menu; headless or server-mode deployments that do not process untrusted ghidra:// URLs are at lower risk.

Exploitability

Exploitability is moderate to high in practical terms. The attack requires user interaction—opening a malicious project file—which means it relies on social engineering or distribution through trusted channels. However, once triggered, exploitation is reliable and requires no special conditions (low complexity, no special privileges). An attacker needs only to craft a malicious .ghidra file or ghidra:// link and convince a target to open it. No zero-click or ambient execution path exists. The Jython gadget chain is well-established in the security research community, making exploit development straightforward for skilled attackers.

Remediation

Upgrade Ghidra to version 12.1 or later. The patched version adds proper input validation and/or restricts deserialization to safe object types during RMI connection handling. Users unable to upgrade immediately should avoid opening project files from untrusted sources and disable or restrict network-based project sharing features if possible. Security teams should also educate analysts about the risks of opening Ghidra projects from external or suspicious sources, treating them similarly to executable files.

Patch guidance

Update Ghidra to 12.1 or a later stable release. Verify the update through the official NSA Ghidra GitHub repository or your organization's software distribution channel. After patching, validate that the installation is correct by checking the version string in Ghidra's About dialog. No special configuration changes are required post-patch. For environments with restricted internet access, pre-stage the patched binary internally or contact NSA for alternative distribution methods.

Detection guidance

Monitor for unexpected Ghidra process spawning of system commands or shell interpreters (cmd.exe, bash, powershell) in correlation with Ghidra window focus or file-open events. Review Ghidra usage logs and RMI connection attempts, especially those initiating from network addresses or involving .ghidra files from external sources. Endpoint detection and response (EDR) tools should flag anomalous child process creation from Ghidra's Java runtime. Network-level detection is limited because the attack occurs post-deserialization on the client; focus instead on behavioral signals at the host level.

Why prioritize this

This vulnerability merits high priority remediation due to the combination of high CVSS score (8.8), ease of exploitation once delivered, and direct impact on security analyst workstations. The attack surface in security research organizations is non-trivial—Ghidra is widely used and analysts regularly exchange projects. Although KEV status is not active, the vulnerability is straightforward to weaponize. Delay in patching leaves team members exposed to potential compromise of sensitive reverse-engineering work and lateral movement into internal networks.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects network-based attack vector, low complexity, no privilege requirement, and high impact across confidentiality, integrity, and availability. The requirement for user interaction (UI:R) prevents a perfect 9.9 score. The score appropriately captures the real-world threat: while not trivially exploitable, the vulnerability enables complete system compromise via a targeted social-engineering campaign against a known user population (security analysts).

Frequently asked questions