Vendor
Ghidra versions before 12.0.3 improperly process annotation directives from automatically extracted binary data, leading to arbitrary command execution when an analyst interacts with the user interface by clicking on a crafted element.