CVE-2026-18718: National Security Agency Ghidra

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.

Affected products

• National Security Agency Ghidra: before 12.1.2 (fixed in 12.1.2)

Published 2026-08-03. Last modified 2026-09-24.