Ghidra 12.1.2 RCE via Malicious Project Import - Suspicious Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects instances where the Ghidra software suite (via analyzeHeadless or ghidraRun) or its associated Java runtime initiates unexpected child processes, such as common system utilities (e.g., cmd.exe, powershell.exe, calc.exe) or executes scripts from untrusted locations like Temp, Downloads, or network shares. This behavior is indicative of potential exploitation attempts, such as arbitrary code execution triggered by a malicious project or script import.