Ghidra contains a vulnerability in its Swift demangler analyzer that allows an attacker to execute arbitrary binaries by placing a crafted Swift tool directory path in the project state. When a victim opens the malicious project, the SwiftDemanglerAnalyzer restores the stored path and SwiftNativeDemangler launches the binary without performing any integrity or signature checks. The attacker’s executable runs with the privileges of the Ghidra process owner and no user confirmation is prompted. This flaw meets the definition of CWE‑427, an uncontrolled search path element, because the analyzer accepts an unchecked path and passes it directly to an execution routine.

The affected product is National Security Agency’s Ghidra. No specific version numbers are listed, so any installation prior to the remediation commit (c03a70d) may be vulnerable. The issue exists in the Swift demangler analyzer component of Ghidra.

The CVSS score of 7.1 classifies the vulnerability as moderate‑to‑high severity. EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a maliciously crafted Ghidra project file; it is triggered when the user opens the project. Because the payload runs under the Ghidra process’s user context and there is no prompt, an attacker who obtains this capability can gain arbitrary code execution with that user’s privileges. The lack of a signature or integrity check for the Swift binary directory means the path can be arbitrarily directed to attacker‑controlled executables.