CVE-2026-100503: Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.
Affected Software
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Analysts and automated analysis pipelines that decompile untrusted or attacker-supplied x86-64 binaries are the relevant exposure group. The impact described is denial of service through a crash of the decompile helper process.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to provide a malicious binary containing a specific x86-64 instruction sequence and have it processed by Ghidra's decompiler. The attack requires user interaction because the binary must be selected or submitted for decompilation.
What can be done if an update cannot be applied immediately?
Avoid decompiling untrusted x86-64 binaries in affected environments, especially in unattended analysis pipelines. Isolate or restrict processing of externally supplied binaries to reduce the opportunity for a crafted input to crash the decompile helper process.
How might an affected environment detect exploitation or attempted exploitation?
The observable effect described is a crash of the decompile helper process while decompiling a crafted x86-64 binary. A helper-process crash alone does not establish that this specific vulnerability was triggered.