Ghidra versions through 12.1.4 implement a heap use‑after‑free flaw in the decompiler’s Funcdata::opInsertAfter function, caused by stale INDIRECT effect‑op references. When a malicious binary is decompiled, the decompile helper process dereferences freed memory, leading to a crash that stops the decompiler from completing its task. This defect does not allow data exfiltration or privilege escalation, but it interrupts analysis workflows and automated pipelines that rely on the decompiler, effectively denying service to analysts. The weakness arises from improper handling of memory after it has been freed.

The vulnerability affects the National Security Agency’s Ghidra suite up to and including version 12.1.4. Users running any of these versions on any platform that utilizes the decompiler component are exposed. The specific files impacted are those in the decompiler package, particularly the modules merge.cc and subflow.cc as indicated by the source reference locations.

The CVSS score of 4.8 classifies the issue as medium severity, reflecting that the impact is limited to denial of service rather than a security breach. EPSS information is not available, which means the current public analysis does not estimate a likelihood of exploitation; however, the attack requires only that the attacker provide a crafted binary, a scenario that is plausible for adversaries seeking to disrupt analysis infrastructure. The vulnerability is not listed in the CISA KEV catalog, indicating that there are no documented incidents or widespread exploitation reports as of the data provided. The most likely attack vector is through an adversary delivering a malicious file for decompilation, potentially automated as part of a malicious pipeline or a targeted attack on analysts. Given the high sensitivity of code analysis in threat hunting, any disruption can have significant operational consequences.