Stack-based Overflow Vulnerability in Ghidra by National Security Agency
CVE-2026-100504

7.3HIGH

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100504?

Ghidra versions up to 12.1.4 are susceptible to a stack-based out-of-bounds write vulnerability found in the decompiler's leftshift128 function. This vulnerability arises when processing negative shift amounts from p-code, allowing attackers to create specially crafted binaries. These binaries exploit specific instruction sequences that cause memory corruption during the decompilation process, potentially leading to unauthorized code execution, putting user systems at serious risk.

Affected Version(s)

ghidra 0 <= 12.1.4

References

https://github.com/NationalSecurityAgency/ghidra/commit/6...
patch
https://github.com/NationalSecurityAgency/ghidra
product
https://github.com/NationalSecurityAgency/ghidra/blob/8b6...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.