CVE-2026-52751 affects Ghidra before version 12.1 and involves unsafe deserialization in the client-side Shared-Project RMI connection code. An attacker can craft a malicious project file with a ghidra:// URL that, when opened through the File → Open Project menu, triggers deserialization of untrusted objects using a Jython 2.7.4 gadget chain. This leads to unauthenticated remote code execution on the client system. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the client system running a vulnerable Ghidra version. This can lead to full compromise of the affected system. The vulnerability requires user interaction (opening a malicious project file) but no authentication or privileges. The impact includes high confidentiality, integrity, and availability consequences due to arbitrary command execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening project files from untrusted sources, especially those using ghidra:// URLs. Monitor official National Security Agency or Ghidra project communications for updates and patches addressing this vulnerability.