Ghidra 12.1.2 ACE/RCE — Unexpected Child Process, .gzf Load, or Decompiler Network Connection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.