CVE-2026-100503

Katalog CVE

CVSS 5.5 · Medium EPSS 0,12%

Kerentanan Use After Free pada nsa ghidra. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features... patch
• https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features... patch
• https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61 patch
• https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler patch · advisory pihak ketiga
• https://github.com/NationalSecurityAgency/ghidra product