{"schema":"threatline.record/2","record":{"id":"CVE-2026-100503","aliases":[],"summary":"Ghidra through 12.1.4 Heap Use-After-Free in Decompiler","details":"Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.","categories":["Unclassified"],"product":"ghidra","vendor":"NationalSecurityAgency","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100503","source_modified_at":"2026-10-22T09:48:42.871Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"ghidra","vendor":"NationalSecurityAgency","versions":[{"version":"0","lessThanOrEqual":"12.1.4","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00117,"percentile":0.01607,"score_date":"2026-10-23"},"published_at":"2026-09-26T00:36:31.894Z","modified_at":"2026-10-22T09:48:42.871Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100503","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T09:48:42.871Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100503","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61","tags":["patch"]},{"source":"CVE List","url":"https://github.com/NationalSecurityAgency/ghidra","tags":["product"]},{"source":"CVE List","url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-29T17:23:50.475506Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T09:48:42.871Z","content_hash":"90be23556d1b8f915527529bb4e2c18e1c433f9c2c9ef75148df0c35739520ef"}}