The flaw is located in the decompiler’s leftshift128 routine where a negative shift amount supplied by p-code allows an out‑of‑bounds write on the stack. Overwriting adjacent stack memory can corrupt control data and, if an attacker gains sufficient influence, may result in arbitrary code execution. The weakness is identified as CWE‑787, a classic buffer overflow defect.

Ghidra supplied by the National Security Agency, version 12.1.4 and earlier, are impacted. No other versions or products are listed as affected.

The CVSS score of 7.3 indicates moderate to high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying current lack of large‑scale exploitation reports. Attackers would need to create a malicious binary containing the specific instruction sequence that triggers the overflow when the decompiler processes it. The attack vector is local or remote depending on whether the decompiler is exposed to untrusted input, but it requires the decompiler to handle the crafted binary.