Which versions of Ghidra are affected by EUVD-2026-36017?

Ghidra's BSim binary-similarity component (versions before 12.1) contains an authenticated SQL injection vulnerability in database filter operations that could allow users to read, modify, or delete…. A patch is available.

How to fix or mitigate EUVD-2026-36017?

Within 24 hours: Audit all Ghidra installations to identify systems running versions before 12.1 and determine whether PostgreSQL databases are accessible from networks containing untrusted users. Within 7 days: Implement network segmentation to isolate Ghidra and PostgreSQL systems, enforce principle of least privilege on user accounts, and enable database query logging for filter operations. Within 30 days: Monitor NSA GitHub for Ghidra 12.1 release and schedule immediate upgrade upon availability.

Ghidra EUVD-2026-36017

Q: What is the CVSS score of EUVD-2026-36017?

EUVD-2026-36017 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-52758 HIGH

SQL Injection (CWE-89)

2026-06-10 VulnCheck

PostgreSQL SQLi Ghidra

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Updated

Jun 10, 2026 - 14:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 10, 2026 - 14:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 10, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 10, 2026 - 14:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 10, 2026 - 14:10 vuln.today

CVE Published

Jun 10, 2026 - 12:42 nvd

HIGH 8.8

DescriptionCVE.org

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Articles & Coverage 2

News 4 New PostgreSQL Vulnerabilities - 2 Critical, 2 High Severity Jun 11, 2026 News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Jun 10, 2026

AnalysisAI

SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers to inject arbitrary SQL via filter types that concatenate user-supplied values directly into PostgreSQL queries. Successful exploitation lets an attacker read, modify, or delete contents of the backing BSim PostgreSQL database used to store function signatures. No public exploit identified at time of analysis, though a vendor security advisory has been published by NSA on GitHub.

Technical ContextAI

Ghidra is the National Security Agency's open-source software reverse engineering (SRE) framework, and BSim is its function-similarity subsystem that stores signature data in a PostgreSQL backend and is queried over a network protocol. The flaw is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): BSim's filter type implementations build SQL by string-concatenating user-controlled filter values rather than using parameterized queries or proper escaping. Because the queries execute against the PostgreSQL backend with the BSim service's privileges, any injected SQL inherits those database rights, giving attackers direct access to the underlying signature store. The CPE confirms scope is the Ghidra application itself (cpe:2.3:a:nationalsecurityagency:ghidra) across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade Ghidra to version 12.1 or later, which introduces proper escaping/parameterization for BSim filter values; see the NSA GHSA advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8r4f-65cr-fwxm for the official fix notes. Where immediate upgrade is not feasible, restrict network reachability of the BSim PostgreSQL-backed server to trusted analysts only (firewall the BSim listening port, place it behind a VPN, or bind it to localhost), and rotate or tighten BSim user credentials to ensure PR:L cannot be satisfied by stale or shared accounts; the trade-off is reduced collaboration since remote analysts will lose access until they reach the trusted network. Additionally, ensure the PostgreSQL role used by BSim follows least privilege so that any successful injection is constrained to BSim's own database rather than wider PostgreSQL contents, accepting the operational cost of more granular role management.