CVE-2026-100504

Katalog CVE

CVSS 7.0 · High EPSS 0,16%

Kerentanan Out-of-bounds Write pada nsa ghidra. Skor CVSS 3.1 7.0 (High) menurut vulncheck.com.

Deskripsi (NVD)

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.0 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features... patch
• https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c patch
• https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128 patch · advisory pihak ketiga
• https://github.com/NationalSecurityAgency/ghidra product
• https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features... product