# cwe_checker > Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. Ghidra disassembles the binary into a common intermediate representation on which its checks run, from simple heuristics to abstract-interpretation data-flow analysis, so it covers the CPU architectures Ghidra supports, including x86, ARM, MIPS and PowerPC. Warnings are printed as text or JSON, and a bundled Ghidra script annotates them in the disassembly for manual review. - Type: Tool - Targets: Binary · Firmware - Category: Native analysis tools - Relationship: Foundation tool - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-19 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/cwe-checker/index.md) ## Requirements & limits - Latest stable release at review: v0.9, published 2024-08-20 as a source release. Prebuilt Docker images on the GitHub container registry are tagged latest (master), stable and v0.9 and are x86 only, although the image can be built natively on ARM. The reviewed master commit is 97 commits after v0.9; CHANGES.md labels it 0.10-dev, with a rewritten P-Code extractor and support for more architectures through a Ghidra update, while the crate manifests still say 0.9.0 and the online documentation covers the stable version. - Local builds need Rust 1.82+ and a Ghidra 10.2+ installation, which make all locates when GHIDRA_PATH is omitted; the Docker image builds on a Ghidra 11.2.1 headless base, and a Nix flake is also provided. Checks are tuned through src/config.json. Analysis of Linux loadable kernel modules, which runs a subset of the checks with its own configuration, and of bare-metal binaries, which needs a per-device configuration such as the bundled STM32F407VG example, is experimental. - Each run takes one binary supplied by the user. The README warns that both false positives and false negatives are to be expected and keeps the CWE-78 OS command injection check disabled on standard runs, so warnings mark code paths for manual review rather than confirmed vulnerabilities. It is also integrated as a plugin in FACT. - LGPL-3.0; the README notice allows version 3 or later. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. ## More in Native binaries - [FLARE-VM](https://awesomerea.org/resources/flare-vm/index.md) · Tool - [B2R2](https://awesomerea.org/resources/b2r2/index.md) · Tool - [rz-ghidra](https://awesomerea.org/resources/rz-ghidra/index.md) · Tool - [dewolf](https://awesomerea.org/resources/dewolf/index.md) · Tool - [decomp2dbg](https://awesomerea.org/resources/decomp2dbg/index.md) · Tool - [E9Patch](https://awesomerea.org/resources/e9patch/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.