Ghidra
Vendor:
First CVE: Jul 17, 2019 · Active for 7 years
22
Total CVEs
More Total CVEs than 95% of tracked products
7.3
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ghidra over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 17, 2019
7 years ago
Most Recent CVE
Jun 10, 2026
47 days ago
CVE Severity & Scoring
Ghidra22 CVEs
32%
50%
14%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local13 (59.1%)
Network9 (40.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low21 (95.5%)
High1 (4.5%)
Unknown0 (0.0%)
User Interaction
None8 (36.4%)
Unknown0 (0.0%)
Required14 (63.6%)
Privileges Required
Low3 (13.6%)
High0 (0.0%)
None19 (86.4%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-13623HIGH In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial | Jul 17, 2019 | 7.8 | 38 | NO | YES |
CVE-2026-52751HIGH Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers c | Jun 10, 2026 | 8.8 | 37 | NO | NO |
CVE-2026-52758HIGH Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-52754HIGH Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-49498HIGH Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolat | Jun 10, 2026 | 8.8 | 35 | NO | NO |
CVE-2026-52750HIGH Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arb | Jun 10, 2026 | 7.8 | 34 | NO | NO |
CVE-2019-16941CRITICAL NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML docu | Sep 28, 2019 | 9.8 | 34 | NO | NO |
CVE-2026-52755HIGH Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers | Jun 10, 2026 | 7.8 | 32 | NO | NO |
CVE-2026-52752HIGH Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious exte | Jun 10, 2026 | 7.8 | 32 | NO | NO |
CVE-2026-4946HIGH Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst i | Mar 29, 2026 | 8.8 | 32 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (22 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.5% of CVEs· 86th percentile
Social Chatter
Signals from CVEs in this product scope (22 CVEs).
Media Mentions
Signals from CVEs in this product scope (22 CVEs).
Top CNAs Publishing CVEs For Ghidra
Top CWEs
Versions
No cataloged versions.