Junglewise Threat Intelligence

CVE-2026-52751: NSA Ghidra unsafe deserialization in Shared-Project RMI connection

CVE-2026-52751 · Severity: high · CVSS 8.8 · Published 2026-06-10

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Executive brief

Ghidra is a popular software reverse-engineering suite used by security researchers. A vulnerability in how it handles shared projects allows an attacker to take complete control of a user's computer if the user opens a specially crafted project file. This could lead to the theft of sensitive research data, installation of malware, or unauthorized access to the user's corporate network.

Technical details

Ghidra versions 9.1 through 12.0.x are vulnerable to unsafe deserialization via the client-side Shared-Project RMI connection code. The vulnerability exists because the client fails to implement an ObjectInputFilter when performing RMI calls (such as reg.list()) against a remote server. An attacker can craft a malicious project file containing a 'ghidra://' URL; when a victim opens this project, the client automatically connects to the attacker-controlled server. The attacker's server can then return a serialized object that leverages a Jython 2.7.4 gadget chain (specifically involving org.python.core.PyMethod) to execute arbitrary system commands. This occurs before any authentication or credential exchange takes place. The issue is resolved in Ghidra 12.1 by implementing restrictive deserialization filters.

Affected products

  • NSA Ghidra 9.1 to 12.0.x

Timeline

  • 2026-05-14: advisory: Initial GitHub Security Advisory published
  • 2026-06-10: disclosed: NVD publication and VulnCheck advisory release
  • 2026-06-10: patched: Fix confirmed in version 12.1

References