Ghidra 12.1.2 CVE-2026-45115 ACE via malicious project or script loading

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

This rule detects potential exploitation of the Ghidra vulnerability CVE-2026-45115, which allows arbitrary code execution during the loading of malicious project files or scripts. It monitors for suspicious child processes (e.g., cmd.exe, powershell.exe, bash) spawned by core Ghidra executables (ghidraRun, analyzeHeadless), which is characteristic of successful exploitation.