CVE-2026-18718
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-08-03
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Active
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.