Integer Truncation Vulnerability in Ghidra by National Security Agency
CVE-2026-116012

2LOW

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
24 October 2026

What is CVE-2026-116012?

Ghidra before version 12.2 contains an integer truncation vulnerability that arises from storing 64-bit string lengths in 32-bit variables. This imperfection could be exploited by attackers, allowing them to input specially crafted packed streams, such as a malicious .sla file. This might lead to the injection of attributes into the decompiler's input or cause crashes in the decompiler process, affecting its stability.

Affected Version(s)

ghidra 0 < 12.2

References

https://github.com/NationalSecurityAgency/ghidra/security...
vendor-advisory
https://github.com/NationalSecurityAgency/ghidra/commit/d...
patch
https://github.com/NationalSecurityAgency/ghidra/releases...
release-notes

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dread (d7ead)
.