CVE-2026-100504: Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1.4
Event History
Frequently Asked Questions
Does exploitation require an attacker to have privileges on the system running Ghidra?
No privileges are required according to the supplied vector. However, exploitation requires a user to decompile an attacker-crafted binary containing the necessary instruction sequences.
Is this exploitable without user interaction?
No. The supplied vector indicates user interaction is required, and the vulnerable code path is reached when the malicious binary is decompiled.
What kind of access does the attacker need?
The supplied vector rates the attack vector as local. The attacker must cause Ghidra to process a crafted binary rather than exploit the issue solely through unauthenticated network access.