Description
Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
Published: 2026-09-26
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Heap Out-of-Bounds Read
Action: Apply Patch
AI Analysis

Impact

Ghidra versions 9.2 through 12.1.4 contain a vulnerable implementation of StringManager::getCodepoint that reads beyond the allocated heap when decoding multi‑byte UTF‑8, UTF‑16, or UTF‑32 characters without checking the remaining buffer length. An attacker can construct a malicious binary with byte sequences that terminate a message with a multi‑byte lead unit. When the decompiler processes this file, the out‑of‑bounds read can cause a crash or cause the decompiler to reveal adjacent heap content in its output, potentially leaking sensitive information.

Affected Systems

The affected product is the National Security Agency’s Ghidra suite. All releases from 9.2 up to and including 12.1.4 are vulnerable. Versions newer than 12.1.4 are presumed fixed but must be verified against official release notes.

Risk and Exploitability

The CVSS v3 score is 4.8, indicating moderate impact. The EPSS score is under 1% and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted binary that the decompiler will parse; the attack is local to the system running Ghidra and does not provide remote code execution. Nonetheless the crash or memory disclosure can disrupt analysis or leak confidential data, so it should be treated with caution.

Generated by OpenCVE AI on September 28, 2026 at 21:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Ghidra to a release that contains the patch (any version newer than 12.1.4). If a fixed release is unavailable, compile the source with commit e37c57f3d9c29511a1860f0a735df53131d403d7 applied to StringManager.cpp.
  • Avoid using the decompiler against untrusted binary files; restrict its use to known safe inputs until a patch is applied.
  • If unable to update or patch immediately, consider disabling the decompiler component for users who need to process potentially malicious binaries.

Generated by OpenCVE AI on September 28, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output. Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
Title Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager

Sat, 26 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Description Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
Title Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
First Time appeared Nsa
Nsa ghidra
Weaknesses CWE-125
CPEs cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*
Vendors & Products Nsa
Nsa ghidra
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Nsa Ghidra
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-05T14:55:05.029Z

Reserved: 2026-09-25T22:14:37.650Z

Link: CVE-2026-100505

cve-icon Vulnrichment

Updated: 2026-10-05T14:51:04.985Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-26T01:17:00.200

Modified: 2026-10-08T16:24:25.650

Link: CVE-2026-100505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T22:00:09Z

Weaknesses