CVE-2026-52750Exploit(nsa / ghidra)

MEDIUMCVSS 8.4 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch nsa ghidra systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.

nsa CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-88

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ghidra

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 4d ago at 2 mentions (2026-06-10); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

nsa

Products

ghidra

Deep dive

Activity timeline6 mentions / 5d

Signal classification3 categories

Exploit

350.0%

Disclosure

233.3%

General

116.7%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	2	Disclosure1General1
2026-06-11	1	Disclosure1
2026-07-02	1	Exploit1
2026-07-31	1	Exploit1
2026-08-01	1	Exploit1

Full discourse6 posts

YogSotho@YogSoth087d
Exploit
⚠️🚨⚠️🚨⚠️🚨⚠️ #BrokenSec - Ghidra RCE Exploit kit Fully weaponized exploits for **CVE-2026-52751** and **CVE-2026-52750** Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc #RCE #security #cybersec #hacking #0days #exploit #antisec #infosec #brokensec #cybernews #ghidra
Post summary
The note announces a fully weaponized exploit kit for CVE‑2026‑52751 and CVE‑2026‑52750, confirming the existence of a PoC and functional exploit code, but giving no evidence of broader active exploitation or mitigation efforts.
311061294.6K
1.9K followersView on X
YogSotho@YogSoth0116d
Exploit
#Ghidra <= 12.1.2 #RCE Exploit Kit Based on public research from `bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc` ## 🎯 Vulnerabilities Covered | CVE | Type | Vector | Impact | Platform | |-----|------|--------|--------|----------| | **CVE-2026-52751** | RMI Deserialization RCE | Malicious `.gpr` project with `ghidra://` URL | **CVSS 8.8** — Remote code execution on project open | All (Java) | | **CVE-2026-52750** | Command Injection | Windows `cmd://` URL annotation | **CVSS 7.8** — Local command execution | Windows only | | Swift Demangler | ACE | Malformed Swift symbol | Crash → RCE via LLVM | All | | TraceRMI | Conditional RCE | Malicious trace config | RCE if tracing enabled | All | | SevenZipJBinding | Native Parser | Malformed 7z archive | JNI crash → RCE | All | ## ⚠️ Affected version **Primary target**: Ghidra 12.1.2 (directly confirmed via `ghidra-12.1.2-rce-ace-calc-poc`) **Likely affected**: Ghidra 11.x through 12.x series (anything with the same `DefaultProject.restore()` → `ServerConnectTask` → RMI deserialization chain) #0days #exploit #ghidra #cybersecurity #CVE #CVSS #swift #windows #antisec #infosec #security #vulnerability
Post summary
The text announces a Ghidra RCE exploit kit with a linked PoC, detailing vulnerability vectors and impact, but offers no patches or evidence of live attacks.
0302171.3K
1.9K followersView on X
CVE@CVEnew138d
Disclosure
CVE-2026-52750 Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers c… https://www.cve.org/CVERecord?id=CVE-2026-52750
Post summary
CVE-2026-52750 is a command injection vulnerability in Ghidra versions prior to 12.1, affecting URL annotation handling on Windows due to improper escaping of cmd.exe metacharacters.
00010136
57.6K followersView on X
John smith@Johnsmithwjvmqq86d
Exploit
BrokenSec - Ghidra RCE Exploit kit Fully weaponized exploits for **CVE-2026-52751** and **CVE-2026-52750** Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc #RCE #security #cybersec #hacking #0days #exploit #antisec #infosec #brokensec #security
Post summary
The tweet announces fully weaponized exploits for CVE-2026-52751 and CVE-2026-52750, referencing a public PoC repository, but it does not report active exploitation or patch availability.
00000120
61 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2026-52750 - Command Injection in Ghidra on Windows. Malicious URLs in comments execute arbitrary commands. CVSS 7.8. Disable URL clicking or block untrusted files. #CVE #Ghidra #infosec A place for #cybersecurity experts mush bookmark https://www.valtersit.com/cve/CVE-2026-52750/
Post summary
The post announces a CVE‑2026‑52750 command injection flaw in Ghidra on Windows, lists its CVSS score, and suggests disabling URL clicking or blocking untrusted files as a mitigation.
0000040
928 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds138d
General
CVE-2026-52750 Command Injection in Ghidra Before 12.1 URL Annotation Handling on Windows https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52750
Post summary
This brief entry references CVE‑2026‑52750, a command injection vulnerability in Ghidra prior to version 12.1 affecting Windows URL annotation handling, with no additional information on exploitation, PoC, or patch.
0000037
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nsa	ghidra	-	-	-

Explore more

Back to dashboard nsa CVEs ghidra vulnerabilities

What researchers are saying

CVE-2026-52750

YogSotho[verified]@YogSoth0Exploit

The note announces a fully weaponized exploit kit for CVE‑2026‑52751 and CVE‑2026‑52750, confirming the existence of a PoC and functional exploit code, but giving no evidence of broader active exploitation or mitigation efforts.

YogSotho[verified]@YogSoth0Exploit

The text announces a Ghidra RCE exploit kit with a linked PoC, detailing vulnerability vectors and impact, but offers no patches or evidence of live attacks.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post announces a CVE‑2026‑52750 command injection flaw in Ghidra on Windows, lists its CVSS score, and suggests disabling URL clicking or blocking untrusted files as a mitigation.

CVE@CVEnewDisclosure

CVE-2026-52750 is a command injection vulnerability in Ghidra versions prior to 12.1, affecting URL annotation handling on Windows due to improper escaping of cmd.exe metacharacters.

John smith@JohnsmithwjvmqqExploit

The tweet announces fully weaponized exploits for CVE-2026-52751 and CVE-2026-52750, referencing a public PoC repository, but it does not report active exploitation or patch availability.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

This brief entry references CVE‑2026‑52750, a command injection vulnerability in Ghidra prior to version 12.1 affecting Windows URL annotation handling, with no additional information on exploitation, PoC, or patch.