CVE-2026-18718: Ghidra Swift Demangler RCE Vulnerability

CVE-2026-18718 Overview

CVE-2026-18718 is an arbitrary code execution vulnerability in Ghidra, the reverse engineering framework maintained by the National Security Agency. The flaw resides in the Swift demangler analyzer, which restores a Swift binary directory path from persisted project state. When a victim opens a malicious Ghidra project, SwiftDemanglerAnalyzer reads the attacker-supplied path and SwiftNativeDemangler executes the referenced binary without integrity or signature verification. The binary runs under the Ghidra process user with no prompt or confirmation. The vulnerability is tracked under [CWE-427: Uncontrolled Search Path Element].

Critical Impact
Opening a shared Ghidra project can trigger silent execution of an attacker-controlled binary under the user's account, enabling local code execution against reverse engineers and malware analysts.

Affected Products

Ghidra (National Security Agency) versions containing the Swift demangler analyzer prior to the patched commit
SwiftDemanglerAnalyzer component
SwiftNativeDemangler and SwiftDemanglerScript components

Discovery Timeline

2026-08-03 - CVE-2026-18718 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18718

Vulnerability Analysis

Ghidra projects persist analyzer options as part of project state. The Swift demangler analyzer stores the filesystem path to the Swift toolchain directory in these options. When a user opens a project, SwiftDemanglerAnalyzer restores this path and passes it to SwiftNativeDemangler, which invokes the referenced Swift executable to demangle symbols. The analyzer performs no verification that the binary is the legitimate Swift toolchain. An attacker crafts a project where the persisted Swift directory points to an attacker-controlled binary. When a victim opens the project, the binary executes automatically under the Ghidra process user without any confirmation prompt. This turns Ghidra projects, which analysts routinely share across teams and public repositories, into an execution vector.

Root Cause

The root cause is a design flaw in how the Swift demangler resolves and trusts persisted configuration data. The SwiftDir option is loaded from untrusted project state and used directly as an executable search path. There is no allowlist, integrity check, or code signature validation before invocation. Persisted state from an external source should not be treated as authoritative for locating executables.

Attack Vector

The attack requires user interaction. An attacker distributes a malicious Ghidra project via file sharing, collaboration platforms, or public repositories. The project bundles or references an attacker-controlled binary and sets the persisted Swift tool directory to point at it. When the victim opens the project in Ghidra, the Swift demangler analyzer resolves the path and executes the binary silently.

java

// Vulnerable pattern (pre-patch) in SwiftDemanglerScript.java
SwiftNativeDemangler nativeDemangler = new SwiftNativeDemangler(options.getSwiftDir());

// Patched pattern - now requires Swift to be on the PATH
SwiftNativeDemangler nativeDemangler = new SwiftNativeDemangler();

Source: Ghidra commit c03a70d — the fix removes the caller-supplied SwiftDir and requires the Swift toolchain to be resolved from the system PATH.

Detection Methods for CVE-2026-18718

Indicators of Compromise

Ghidra projects received from untrusted sources containing a populated Swift tool directory option in persisted analyzer configuration
Child processes spawned by the Ghidra JVM (java) that reference binaries outside standard Swift toolchain install paths
Execution of binaries located within project directories or user-writable paths shortly after a Ghidra project is opened
Filesystem writes by Ghidra to unexpected locations followed by immediate execution of those artifacts

Detection Strategies

Monitor process trees for java or Ghidra launcher processes spawning executables from non-standard paths, particularly from user download directories or project folders
Audit shared Ghidra project archives (.gpr, .rep) for embedded binaries and analyzer configuration referencing local executable paths
Alert on any Swift toolchain invocation that does not originate from a signed, expected install location

Monitoring Recommendations

Log child-process creation for all Ghidra installations on analyst workstations and forward events to a centralized data lake
Correlate project-open events with subsequent process execution to identify silent binary launches
Track file modifications to Ghidra project state (project.prp, tool state files) originating from external sources

How to Mitigate CVE-2026-18718

Immediate Actions Required

Update Ghidra to a build that includes commit c03a70d or later, where the Swift demangler resolves swift from PATH instead of persisted project state
Do not open Ghidra projects from untrusted sources until patched
Review any recently opened third-party projects for evidence of unexpected binary execution under the Ghidra process user
Restrict Ghidra to run under a low-privilege user account isolated from sensitive data

Patch Information

The fix is committed to the Ghidra repository in commit c03a70d under change GP-7045. The patch removes the constructor overload that accepted a caller-supplied Swift directory and forces SwiftNativeDemangler to locate the Swift toolchain via the system PATH. See the GHSA-pcfh-853f-q3gh advisory and the VulnCheck advisory for additional detail.

Workarounds

Disable the Swift demangler analyzer for any project opened from an untrusted source before allowing initial analysis to run
Open untrusted projects inside a sandboxed virtual machine with no network access and no sensitive credentials
Inspect project analyzer options and clear any populated Swift tool directory path before opening in a production environment
Apply operating-system-level application control to block execution of unsigned binaries from user-writable directories

bash

# Verify installed Ghidra includes the fix commit
cd /path/to/ghidra
git log --oneline | grep c03a70d

# On Linux, restrict Ghidra to a dedicated low-privilege user
sudo useradd -m -s /bin/bash ghidra-analyst
sudo -u ghidra-analyst /opt/ghidra/ghidraRun