Arbitrary Code Execution in Ghidra's Swift Demangler Analyzer by National Security Agency
CVE-2026-18718

7.1HIGH

Key Information:

Vendor: National Security Agency
Status: Ghidra
Vendor: CVE Published:; 3 August 2026

🔔 Create National Security Agency Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18718?

Ghidra features a flaw in its Swift demangler analyzer that enables attackers to execute arbitrary code. By creating a malicious Ghidra project with a crafted Swift tool directory path, an attacker can manipulate the context from which binaries are restored and executed. Upon opening the compromised project, Ghidra fails to verify the integrity or signature of the resolved binaries, allowing the execution of harmful executables with the same privileges as the Ghidra process user, leading to potential system exploitation.

Affected Version(s)

Ghidra 0 < 12.1.2

Ghidra 12.1.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18718
Created by sn0x-sharma