Ghidra CVE-2026-52758

Attacker must possess valid low-privilege credentials to a BSim server (PR:L) and must be able to reach the BSim network query protocol endpoint backing PostgreSQL; the vulnerable code path is specifically the BSim filter types that accept user-supplied values. Exploitation is limited to deployments that actually run a networked BSim server with a PostgreSQL backend - pure single-user Ghidra installs without BSim are not exposed via the described vector. No user interaction is required (UI:N) and complexity is low (AC:L), so any authenticated BSim user submitting a search request is positioned to exploit it; the practical limit is whether the BSim server is exposed beyond trusted analyst networks.

The CVSS 4.0 score of 8.7 (High) reflects network attack vector (AV:N), low complexity (AC:L), and high impact to confidentiality, integrity and availability of the vulnerable component (VC:H/VI:H/VA:H), but requires low privileges (PR:L) - meaning the attacker must already be an authenticated BSim user. There is no EPSS score, KEV listing, or public POC provided in the source data, so the signals point to a real but not-yet-weaponized issue: serious where BSim servers are network-exposed to semi-trusted users, but lower urgency for isolated single-analyst or air-gapped deployments. The PR:L requirement is the key limiting factor - internet-exposed BSim servers with weak account hygiene are the realistic concern, not opportunistic mass exploitation. No conflicting signals were observed in the supplied data; absence of EPSS/KEV simply reflects this being a recently disclosed, vendor-coordinated issue rather than evidence of low real-world risk.

An attacker with low-privileged credentials to a network-reachable BSim server crafts a malicious filter value within a BSim search request, embedding SQL statements that escape the intended query context. Because the filter is concatenated directly into the PostgreSQL query, the attacker's payload executes with the BSim service's database privileges, allowing them to exfiltrate the entire signature corpus, tamper with similarity results to mislead reverse engineering efforts, or drop tables to deny service. No public exploit identified at time of analysis, but the vulnerability class is well-understood and trivial to weaponize once a BSim filter syntax reference is consulted.