Ghidra before version 12.1 contains a heap-use-after-free flaw in the HighVariable::merge() routine that can be triggered by a crafted binary opened in the decompiler view. The bug causes stale pointers in a cache to be dereferenced, allowing an attacker to read or write the flags field of freed memory. This memory corruption can lead to unpredictable program behavior, including potential arbitrary code execution locally if an attacker controls the binary being decompiled.

The National Security Agency’s Ghidra decompiler software is affected on all releases prior to 12.1. Users who run any older version of Ghidra and open untrusted binaries in the decompiler are at risk.

The CVSS score of 4.6 indicates moderate severity. Exploitation requires a user to load a malicious binary, so remote attackers cannot trivially trigger the flaw; however, local attackers or those with privileged access to the system can abuse it. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited yet.