CVE-2026-52751

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1

Description An unsafe deserialization issue exists in the client-side Shared-Project RMI connection code, enabling unauthenticated remote code execution. An attacker can create a malicious project file containing a ghidra:// URL. When this file is opened through the File → Open Project menu, the application deserializes untrusted objects using a Jython 2.7.4 gadget chain—a sequence of executable code fragments—to run arbitrary commands.

Recommendations Update to version 12.1.