CVE-2026-52758 Overview
CVE-2026-52758 is a SQL injection vulnerability [CWE-89] in Ghidra versions before 12.1. The flaw resides in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL through the BSim network query protocol. Successful exploitation allows attackers to read, modify, or delete data in the backing PostgreSQL database used by BSim for binary similarity analysis.
Critical Impact
Authenticated remote attackers can execute arbitrary SQL against the BSim PostgreSQL database, compromising the confidentiality, integrity, and availability of stored binary intelligence data.
Affected Products
- Ghidra versions prior to 12.1
- Ghidra BSim component with PostgreSQL backend
- Deployments exposing the BSim network query protocol
Discovery Timeline
- 2026-06-10 - CVE-2026-52758 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-52758
Vulnerability Analysis
Ghidra is an open-source software reverse engineering framework maintained by the National Security Agency (NSA). BSim is its binary similarity search component, which stores function signatures and metadata in a PostgreSQL database. Clients query the BSim server using a network protocol that accepts filter expressions to narrow result sets.
The vulnerability stems from how BSim constructs SQL queries from filter values. Several filter type implementations concatenate attacker-controlled input directly into query strings instead of using parameterized statements. An authenticated client can supply crafted filter values that break out of the intended SQL context. This permits arbitrary SQL execution within the privileges of the BSim database role.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. BSim filter types build query fragments through direct string concatenation. No escaping routine or prepared-statement binding is applied to user-supplied filter values before query execution against PostgreSQL.
Attack Vector
Exploitation requires network access to the BSim server and valid low-privilege credentials. The attacker submits a BSim search request containing a malicious filter value. The server passes the value into a vulnerable filter type that concatenates it into SQL. The injected payload executes against PostgreSQL with the rights of the BSim service account, enabling data reads, modifications, deletions, and potentially follow-on attacks against database internals.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-8r4f-65cr-fwxm and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-52758
Indicators of Compromise
- BSim query logs containing filter values with SQL metacharacters such as single quotes, semicolons, --, /*, or UNION SELECT.
- Unexpected PostgreSQL statements executed by the BSim service account, including DROP, DELETE, UPDATE, or schema enumeration against pg_catalog.
- Anomalous outbound or interactive connections from the BSim host following filter-heavy search requests.
Detection Strategies
- Enable PostgreSQL statement logging (log_statement = 'all') on the BSim database and review queries for syntactic anomalies in filter clauses.
- Inspect BSim server logs for filter values containing SQL keywords or comment sequences submitted by low-privilege users.
- Correlate authenticated BSim sessions with bursts of failed or unusually long-running database queries.
Monitoring Recommendations
- Forward Ghidra BSim and PostgreSQL logs to a centralized SIEM for query-level analysis.
- Alert on use of SQL comment tokens or UNION-based payloads inside BSim search parameters.
- Track changes to BSim tables and database role permissions to detect tampering after a successful injection.
How to Mitigate CVE-2026-52758
Immediate Actions Required
- Upgrade Ghidra to version 12.1 or later, which addresses the BSim filter SQL injection.
- Restrict network access to BSim servers using firewall rules or VPN-only reachability until patching is complete.
- Rotate BSim database credentials and audit PostgreSQL data for unauthorized modifications.
Patch Information
The issue is fixed in Ghidra 12.1. Apply the upstream release from the Ghidra security advisory GHSA-8r4f-65cr-fwxm. Organizations running shared BSim infrastructure should coordinate upgrades across all client and server instances.
Workarounds
- Limit BSim server access to trusted analysts on isolated network segments.
- Run the BSim PostgreSQL role with least privilege, removing rights to drop or alter tables outside the BSim schema.
- Disable or restrict the BSim network query protocol where binary similarity search is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
