CVE-2026-18718 is an arbitrary code execution vulnerability in the National Security Agency's Ghidra software, specifically in the Swift demangler analyzer. The flaw arises because the SwiftNativeDemangler executes a binary resolved from a persisted Swift tool directory path stored in a Ghidra project without verifying its integrity or signature. By supplying a malicious project with a crafted Swift tool directory path, an attacker can cause Ghidra to run arbitrary executables under the user's context when the project is opened. This vulnerability requires local access to open the malicious project and user interaction to trigger execution.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Ghidra, potentially leading to full compromise of the user's environment. There is no indication of remote exploitation without user interaction. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or suspicious Ghidra projects, especially those containing Swift tool directory paths. Monitor official NSA Ghidra advisories for updates and patches.