Is CVE-2026-4946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4946 being exploited in the wild.

How severe is CVE-2026-4946?

High severity, with a CVSS score of 8.8, published 29 March 2026.

Which products and versions are affected?

National Security Agency Ghidra prior to 12.0.3.

Is there a fix for CVE-2026-4946?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4946 attacked?

It is attacked over the network.

Am I affected by CVE-2026-4946?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4946: National Security Agency Ghidra arbitrary code execution via @execute annotation

CVE-2026-4946 · Severity: high · CVSS 8.8 · Published 2026-03-29

Ghidra is a reverse-engineering framework used by security analysts to examine and understand binary files. A malicious binary can trick analysts into executing attacker-controlled commands by embedding hidden instructions in what appear to be innocent comments. When an analyst clicks on these disguised links during code analysis, arbitrary commands execute on their machine with full access to their data and systems.

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Quick answers

Is CVE-2026-4946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4946 being exploited in the wild.
How severe is CVE-2026-4946?: High severity, with a CVSS score of 8.8, published 29 March 2026.
Which products and versions are affected?: National Security Agency Ghidra prior to 12.0.3.
Is there a fix for CVE-2026-4946?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4946 attacked?: It is attacked over the network.
Am I affected by CVE-2026-4946?: Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection flaw in Ghidra's annotation processing. The @execute annotation feature, designed to allow trusted user-authored comments to trigger commands, is also parsed in comments automatically generated during binary analysis (specifically CFStrings extracted from Mach-O binaries by CFStringAnalyzer). The ExecutableTaskStringHandler parses and executes commands in the format {@execute /path/to/binary args DisplayText} directly via ProcessBuilder without validation, sanitization, or user confirmation. Attack requires a crafted binary and user interaction (clicking a link), but no elevated privileges. An attacker can achieve full code execution with analyst machine access. Patch available in version 12.0.3 and later.

Affected products

National Security Agency Ghidra prior to 12.0.3

Timeline

2026-02-19: disclosed: GitHub Security Advisory GHSA-mc3p-mq2p-xw6v published
2026-03-29: advisory: CVE-2026-4946 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.