Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

Advisories

Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

Severity: low
Date: 10/24/2026
Affecting: ghidra >= 0, < 12.2
CVE: CVE-2026-116012
CWE: CWE-197 Numeric Truncation Error
CVSS: 2.0
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-v423-5vh7-c7jw)
https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0
ghidra Ghidra_12.2_build Release Notes
https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671
Credit: dread (d7ead)
Description: Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo