Heap Out-of-Bounds Read Vulnerability in Ghidra by National Security Agency

CVE-2026-100505

What is CVE-2026-100505?

Ghidra versions between 11.2 and 12.1.4 are vulnerable to a heap out-of-bounds read in the StringManager::getCodepoint function. This vulnerability arises when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without proper validation of the remaining buffer length. An attacker could exploit this flaw by crafting specially designed binaries that contain constant byte stores ending in multi-byte lead units. Such crafted binaries can provoke out-of-bounds reads, leading to crashes of the decompiler or unintended leaks of adjacent heap memory into the decompiled output, significantly compromising the integrity and security of the application.

References