CVE-2026-116012: Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Published Oct 24, 2026
·Updated
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Affected Software
1 affected component
Ghidra Ghidra<12.2
Event History
Oct 24, 2026
CVE Published
via MITRE·11:40 AM
Data Sourced
via MITRE·11:40 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Ghidra versions are affected?
Ghidra versions before 12.2 are affected. Updating to Ghidra 12.2 removes the affected version range.
2
What access does an attacker need to exploit this issue?
The attacker needs to get a crafted packed stream into the decompiler’s input, such as through a malicious .sla file. The CVSS vector indicates local attack conditions and required user interaction.
3
How can I determine whether an installation needs remediation?
Check the installed Ghidra version. Any version earlier than 12.2 should be treated as affected.