Link following in Ghidra - #VU158269
Published: October 28, 2026
Vulnerability details
The vulnerability allows a local user to recursively delete files with another user's privileges, causing data loss and denial of service.
The vulnerability exists due to improper symbolic link resolution in Ghidra's packed-database cleanup when processing temporary directories during startup. A local user can plant a directory symlink with a name matching ~tmp*.pdb.db in the cleanup directory and induce the victim to start Ghidra to delete the target directory's contents with the victim's privileges. The per-user temporary directory handling accepts an existing attacker-owned directory without verifying ownership, allowing the planted symlink to reach the cleanup routine.
The target directory's modification time must be at least one week old for cleanup to process it; selecting an older directory avoids the need for a race.