CVE-2026-100505: Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra 11.2 through 12.1.4 are exposed when they analyze a maliciously crafted binary. Exploitation is local and requires user interaction, but does not require attacker privileges.
What must an attacker provide to trigger the flaw?
The attacker needs to craft a binary containing constant byte stores that end in multi-byte UTF-8, UTF-16, or UTF-32 lead units. Processing that binary can cause the decompiler to read beyond the heap buffer.
What should analysts look for if exploitation is suspected?
Potential indicators are decompiler crashes or unexpected adjacent heap-memory content appearing in decompiled output after analyzing an untrusted binary. The stated impacts are information disclosure and reduced availability.