Ghidra versions prior to 12.1 contain a heap-use-after-free flaw in SleighBuilder::generatePointerAdd due to iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector. The condition allows attackers to corrupt memory by decompiling malicious binaries through the publicly exposed Sleigh::oneInstruction C++ API. Such memory corruption can lead to arbitrary code execution or other unintended behavior as it breaks the integrity of the program’s heap.

The affected product is NSA’s Ghidra, all releases before 12.1, including any derivative consumers that rely on the Sleigh library and use the oneInstruction API to process binaries. If a system runs Ghidra 12.0 or earlier and accepts decompilation requests for external binaries, it is susceptible.

The CVSS score is 6.9, indicating moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is unavailable, but the lack of a known public exploit does not diminish the risk. The flaw is exploitable by an adversary who can supply malicious binaries to the Sleigh::oneInstruction interface, likely requiring local execution or remote API access. If the API is exposed, the memory corruption could be leveraged to gain control of the application or affect downstream SLEIGH consumers. The risk remains significant for systems that process untrusted binaries without proper isolation.