An engineered binary containing an @execute annotation tricks Ghidra’s auto‑analysis into displaying clickable text that, when the analyst clicks it, runs attacker‑supplied commands on the analyst’s machine. This abuses an OS command injection weakness (CWE‑78) and results in arbitrary code execution within the Ghidra process, compromising confidentiality, integrity, and availability of the system hosting the analysis.

The flaw is present in all releases of Ghidra from the National Security Agency that precede version 12.0.3. Users who open malcrafted binaries containing CFStrings or similar metadata in these older versions are vulnerable whenever they interact with the generated annotation sentences.

The vulnerability carries a CVSS base score of 8.8, marking it high severity. No EPSS score is available and the flaw is currently not listed in CISA’s KEV catalog. The attacker must supply a malicious binary and rely on the analyst clicking the deceptive annotation; if this happens the exploit succeeds and commands execute with the privileges of the Ghidra process.