CyberRota Analysis
AI-GeneratedGhidra is vulnerable to an arbitrary code execution flaw in the Swift demangler analyzer, which can be exploited by an attacker through a malicious Ghidra project containing a crafted Swift tool directory path. This allows the execution of arbitrary binaries without integrity or signature verification, enabling attackers to run their executables under the Ghidra process user without any user prompts. Organizations using Ghidra, particularly those in software development and security analysis, should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.