Introduction
The NSA's Ghidra reverse engineering framework, used daily by malware analysts and security researchers across government and industry, contains an unauthenticated remote code execution vulnerability that opening a shared project file is enough to trigger. CVE-2026-52751, with a CVSS score of 8.8, comes from a missing deserialization filter in Ghidra's client-side RMI connection code. An attacker can use it to execute arbitrary commands on the victim's workstation through a gadget chain built from Ghidra's bundled Jython library.
Technical Information
Root Cause: Asymmetric Deserialization Filtering
The core issue is a trust boundary failure in Ghidra's Shared Project feature. When a Ghidra client connects to a Ghidra Server via RMI, it deserializes returned objects using ObjectInputStream.readObject() with no ObjectInputFilter in effect. The Ghidra Server installs a strict allow-list filter at startup, but the client side never received equivalent protection. Because of this asymmetry, if a client can be tricked into connecting to a malicious RMI endpoint, the attacker controls what gets deserialized.
This is a textbook case of CWE-502 (Deserialization of Untrusted Data), the vulnerability class behind some of the most impactful Java exploits of the past decade.
Silent Connection via ghidra:// URLs in Project Files
The attack starts with Ghidra's project file format. The DefaultProject.restore() method processes the project's projectState XML and silently opens a ghidra:// connection for every <OPEN_REPOSITORY_VIEW URL="..."/> element it encounters. Ghidra shows no confirmation dialog or warning, and the user gets no chance to inspect the URL before the connection is made. The victim performs File, Open Project on what appears to be a normal Ghidra project, and the client connects to the attacker's server automatically.
The Jython 2.7.4 PyMethod Gadget Chain
Ghidra bundles jython-standalone-2.7.4.jar, which provides the classes the exploitation chain needs. The PyMethod class implements java.lang.reflect.InvocationHandler and lacks a readResolve guard, so it works as a deserialization gadget. The chain follows a well-known pattern from Java deserialization research:
| Step | Action | Component |
|---|---|---|
| 1 | Attacker crafts malicious Ghidra project file | projectState XML with ghidra:// URL |
| 2 | Victim opens project via File, Open Project | DefaultProject.restore() |
| 3 | Client silently connects to attacker-controlled server | RMI connection via ghidra:// URL |
| 4 | Server returns malicious serialized object | No ObjectInputFilter on client |
| 5 | ObjectInputStream.readObject() deserializes payload | Jython PyMethod gadget chain |
| 6 | PriorityQueue.readObject() triggers gadget chain | InvocationHandler proxy |
| 7 | Arbitrary command execution on victim machine | Runtime.getRuntime().exec() |
The ysoserial project has included a Jython1 gadget exploiting similar classes, and Tenable documented the PyMethod InvocationHandler technique back in 2016. The gadget chain is not new. This vulnerability is significant because of its delivery mechanism and its target audience.
Delivery Vectors and Social Engineering Surface
The advisory names delivery channels that security researchers rely on every day: email attachments, Slack and Teams direct messages, AirDrop, shared cloud drives, git clone operations, and sample sharing forums. Reverse engineers and malware analysts routinely exchange project files and analysis artifacts through these channels, which makes social engineering a highly plausible route to exploiting this vulnerability.
CVSS Scoring
The sources disagree on the score:
| Source | CVSS Version | Score |
|---|---|---|
| NVD | v3.1 | 8.8 |
| GHSA Advisory | v3.1 | 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) |
| VulnCheck | v4 | 8.6 |
The GHSA advisory uses an Attack Vector of Local (AV:L), because the victim must open a local file. The NVD score of 8.8 likely uses a Network attack vector. Whatever the specific score, all three assessments rate this High severity, with full impact on confidentiality, integrity, and availability.
Affected Systems and Versions
All Ghidra versions containing the Shared Project feature are vulnerable. That means every release from version 9.1 onward, up to but not including 12.1. The advisory states that the code paths involved are unchanged in every release since the feature was introduced.
Ghidra 12.1, released on May 13, 2026, is the only fixed version. No configuration workaround exists to disable the vulnerable code paths in earlier versions.
Vendor Security History
Ghidra has had at least two High-severity RCE vulnerabilities disclosed in 2026, and both are trust boundary failures:
| Vulnerability | CVE | CVSS | CWE | Affected Versions | Patched Version |
|---|---|---|---|---|---|
| RMI Deserialization RCE | CVE-2026-52751 | 8.8 | CWE-502 | < 12.1 | 12.1 |
| Annotation Command Injection RCE | CVE-2026-4946 | 8.8 | CWE-78 | < 12.0.3 | 12.0.3 |
CVE-2026-4946 abuses annotation directives in auto-extracted binary data to inject commands. Both vulnerabilities come from the same architectural weakness. Ghidra fails to distinguish between trusted and untrusted data at critical processing boundaries.
The Ghidra Team is not currently authorized to generate CVEs directly from security advisories, so CVE-2026-52751 was assigned through VulnCheck's disclosure process. Researcher @jro-calif reported the vulnerability, and the fix was developed jointly with Oceanit's Software and Cybersecurity team.
References
- NVD Entry for CVE-2026-52751
- GHSA Advisory: Ghidra RCE via Unfiltered RMI Deserialisation
- VulnCheck Advisory: Ghidra Remote Code Execution via Unfiltered RMI Deserialization
- Ghidra Commit 91a2691 (Fix)
- Ghidra Releases (including 12.1)
- Ghidra Security Overview
- NSA Ghidra Official Page
- Oceanit: Engineers Help Fix Vulnerability in NSA Cybersecurity Tool
- Tenable: Expanding on a Known Vulnerability: Attacking with Jython
- CVE-2026-4946 Detail (Related Ghidra RCE)
- GHSA Advisory for CVE-2026-4946
- SentinelOne: CVE-2026-4946
- Java Deserialization Gadget Chains (Klogix Security)
- GadgetInspector: Byte Code Analyzer for Deserialization Gadgets
