Technical impact
This vulnerability arises from an integer truncation in the decompiler parser, where 64‑bit string lengths are mistakenly stored in 32‑bit variables. The truncation can allow an attacker to inject malicious attributes into the decompiler’s input stream or trigger a crash. The outcome is a loss of service or potential unintended code execution within the decompiler, but no direct remote code execution or data exfiltration is described in the advisory.
Affected Systems
The issue affects National Security Agency Ghidra releases prior to version 12.2. Users running Ghidra 12.1.4 or earlier are vulnerable. The vulnerability is specific to the PackedDecode::skipAttribute routine in marshal.cc within the decompiler component. No other products or vendors are listed as affected.
Risk and Exploitability
The CVSS score of 2 indicates a low severity, and the EPSS score is not available, suggesting few public exploits or low exploitation likelihood. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list, further implying limited real‑world attacks. The most probable attack vector is a local user who opens a crafted packed file, such as a .sla file, in Ghidra—leading to a decompiler crash or controlled attribute injection.
