Critical severity · published Sep 28, 2019
CVE-2019-16941
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML…
9.8
CVSS
5.1%
EPSS
No
On KEV
Description
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GH
Ghidra · Nsa
through 9.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16941
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16941
Third Party Advisory
https://github.com/NationalSecurityAgency/ghidra/blob/79d8f164f8bb8b15cfb60c5d4faeb8e1c25d15ca/Ghidra/Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java#L187-L188
github.com
https://github.com/NationalSecurityAgency/ghidra/commit/a17728f8c12effa171b17a25ccfb7e7d9528c5d0
Exploit
https://github.com/NationalSecurityAgency/ghidra/issues/1090
github.com
https://github.com/purpleracc00n/CVE-2019-16941
twitter.com
https://twitter.com/NSAGov/status/1178812792159248385
www.symantec.com
https://www.symantec.com/security-center/vulnerabilities/writeup/110223?om_rssid=sr-advisories
More from Ghidra
9.8
CVE-2023-22671
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with…
9.1
CVE-2019-13625
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file
8.8
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
8.8
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
8.8
CVE-2026-52751
Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection