SQL injection in Ghidra - CVE-2026-52758
Published: May 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU131580
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52758
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject arbitrary SQL commands.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in BSim search filter types when processing XML protocol messages received over the BSim network query protocol. A remote user can send specially crafted filter values to inject arbitrary SQL commands.
Multiple filter types concatenate user-supplied values directly into SQL queries without escaping or parameterization, while the affected values originate from network XML messages.
Affected software
Ghidra
How to mitigate CVE-2026-52758
Install security update from vendor's website.
Ghidra - update to 12.1