CVE-2026-116012GHSA-v423-5vh7-c7jw
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
NationalSecurityAgency ghidra
CVSS
2.0LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 12.2ghidraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 24 Oct 2026, 11:40 UTCPublishedCVE List
- 24 Oct 2026, 19:13 UTCExploit code publicGitHub proof-of-concept repositories
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Text from CVE List
Affected versions 1
- ghidraaffected: all versions before 12.2CVE List
References 5
- github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0Fixvia CVE List
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jwAdvisoryvia CVE List
- github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671Advisoryvia CVE List
- vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parserAdvisoryvia CVE List